Re: Welchia/Nachi virus doubt
From: Doug Knox MS-MVP (dknox_at_mvps.org)
Date: 11/07/03
- Next message: anonymous_at_discussions.microsoft.com: "Spyware"
- Previous message: Doug Knox MS-MVP: "Re: IIS workstation Limitations on Win Xp"
- In reply to: Tojo: "Welchia/Nachi virus doubt"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 7 Nov 2003 10:13:46 -0500
They are still infected. See www.dougknox.com, Win XP Utilities, Create
Emergency Copies of Critical XP System Utilities. This small VB Program
will create backup, usable copies of Task Manger, Regedit and MSConfig
(named Taskmgr1.exe, Regedit.com and MSConfig1.exe) in a new folder
C:\EmergencyUtil. Many virus programs will intercept these programs, based
on their original file name. The modified file names, allow them to be run.
Open Windows Explorer to C:\EmergencyUtil and double click the application
you need. The next revision will allow you to browse for the folder you
want to place the backups in.
Additionally, see the Win XP Utilities section for Startup Programs Tracker.
This small utility scans your system for startup programs and running
processes. It also allows you to create a log file that can be copied and
pasted into a newsgroup post. The contents of the program window are also
copied to the Windows Clipboard, automatically. For replies to newsgroup
posts, do NOT include the Running Services, unless its absolutely necessary.
-- Doug Knox, MS-MVP Windows XP/ Windows Smart Display Win 95/98/Me/XP Tweaks and Fixes http://www.dougknox.com -------------------------------- Associate Expert ExpertZone - http://www.microsoft.com/windowsxp/expertzone -------------------------------- Please reply only to the newsgroup so all may benefit. Unsolicited e-mail is not answered. "Tojo" <tojo@nebraska.com> wrote in message news:bog9fn$1dgq61$1@ID-196997.news.uni-berlin.de... > Hello > > A friend of mine got infected with the Welchia/Nachi worm virus in it's XP > machine. I ran the Stinger utility and it said it was removed from the > system but I still see 5 svchosts processes in the processes list, the > regedit and NAV processes are stopped seconds after they're started and none > of the Microsoft security patches can be installed. The integrated firewall > is on. Could somenone give any directions on this please? > > Thanks, > Tojo > >
- Next message: anonymous_at_discussions.microsoft.com: "Spyware"
- Previous message: Doug Knox MS-MVP: "Re: IIS workstation Limitations on Win Xp"
- In reply to: Tojo: "Welchia/Nachi virus doubt"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
