W32.Welchia.Worm wont delete !

[.·°^°·.+Nick S+.·°^°·.]

Hello, my Norton Antivirus alerted me my PC was infected with this virus
late last night, where it came from is a complete Mystery to me as I'm very
careful.
Is there a way to erradicate this from my system. I'm running a Pentium 3
with Windows XP.
I've run the Fix blast exe and it tells me my computer is not infected ???
Any help is much appreciated.

[StarScripter]

Post by .·°^°·.+Nick S+.·°^°·.
Hello, my Norton Antivirus alerted me my PC was infected with this virus
late last night, where it came from is a complete Mystery to me as I'm
very careful.
Is there a way to erradicate this from my system. I'm running a Pentium 3
with Windows XP.
I've run the Fix blast exe and it tells me my computer is not infected ???
Any help is much appreciated.

Hi,
Try this removal tool:
http://vil.nai.com/vil/stinger/
hth

[.·°^°·.+Nick S+.·°^°·.]

thamks for the program . it found and deleted the Nachia virus, but my
Norton Realtime protection is going crazy, teeling me that its found the
Welchia Worm .

[.·°^°·.+Nick S+.·°^°·.]

ok, I managed to quarantine it after dissabling System Restore. Man, that
was a nasty little bugger.
Could someone please shed some light on how this virus is spread , it only
surfaced after I downloaded a valid exe file from File Forum. I scanned it
for virus's before even installing it and it came up clean. Very strange.

[m***@tadyatam.invalid]

Post by .·°^°·.+Nick S+.·°^°·.
ok, I managed to quarantine it after dissabling System Restore. Man, that
was a nasty little bugger.
Could someone please shed some light on how this virus is spread , it only
surfaced after I downloaded a valid exe file from File Forum. I scanned it
for virus's before even installing it and it came up clean. Very strange.

http://vil.nai.com/vil/content/v_100559.htm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

--J
Replies to: jNpolak(at)Ojuno(dot)Tcom

[Willie Nickels]

Post by .·°^°·.+Nick S+.·°^°·.
ok, I managed to quarantine it after dissabling System Restore. Man, that
was a nasty little bugger.
Could someone please shed some light on how this virus is spread , it only
surfaced after I downloaded a valid exe file from File Forum. I scanned it
for virus's before even installing it and it came up clean. Very strange.

Could it be that your virus scanner's definitions did not include this
worm at the time you downloaded it?

Be very careful about the sources you "trust".

[tvrtka]

simantec said for Welchia :
W32.Welchia.Worm does the following:

Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web
site, install it, and then reboot the computer.
Checks for active machines to infect by sending an ICMP echo request, or
PING, which will result in increased ICMP traffic.

Attempts to remove W32.Blaster.Worm.

????? A "good" worm! Can't believe. Guess some lazy admin wrote this
tool and it get away!