Re: welchia worm
From: Larry Samuels MS-MVP XP \(Shell/User\) (larry_at_mvps.org)
Date: 08/24/03
- Next message: Larry Samuels MS-MVP XP \(Shell/User\): "Re: Same Error as Pete Soden"
- Previous message: Larry Samuels MS-MVP XP \(Shell/User\): "Re: Security Update MS03-026 for wundows XP (823980)"
- In reply to: Thom Campbell: "welchia worm"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 23 Aug 2003 18:45:11 -0400
That is the so-called "good worm" which has several names:
Nachi, and Welchia:
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
McAfee Stinger will remove this worm
http://vil.nai.com/vil/stinger/
If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.
-- Larry Samuels MS-MVP (Windows-Shell/User) Associate Expert Unofficial FAQ for Windows Server 2003 at http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm Expert Zone - www.microsoft.com/windowsxp/expertzone "Thom Campbell" <tcampbell2@indy.rr.com> wrote in message news:02e001c36985$bbc43230$a001280a@phx.gbl... > I am using my WIN98SE machine topost. My wife's XP machine > has acquired the welchia worm, identified by Norton 2002. > She has regularly run updates and virus scans but has the > worm. Machine will boot then lock up after 15 secs. I have > the location of the infected file as > C:\WINDOWS\system 32\TFTP3356 The problem is how to keep > machine in operation long enough to open Windows explorer > and delete infection????
- Next message: Larry Samuels MS-MVP XP \(Shell/User\): "Re: Same Error as Pete Soden"
- Previous message: Larry Samuels MS-MVP XP \(Shell/User\): "Re: Security Update MS03-026 for wundows XP (823980)"
- In reply to: Thom Campbell: "welchia worm"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
