• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

Worm_msblaster.d

dadecamp

under worked, over paid
#1
My virus scanner, PC-Cillin, has found this in:
C:\WINDOWS\system32\wins\DLLHOST.EXE

How do I get rid of it? Virus scanner can't delete it.
 

dadecamp

under worked, over paid
#6
Nothing found :
W32.Blaster.Worm has not been found on your computer.

My virus scanner still says its there.
What next?
 
#7
Run "TASKKILL /IM dllhost.exe" (or open the task manager and kill the process) then open up C:\WINDOWS\system32\wins\ and delete the file.

Its not Blaster, its welchia :)
 
#9
Open task manager and on the process tab find dllhost.exe, right click and hit end process (that may come back access denied to but try ir) then delete it.

Can't belive PC-Cillin wont remove it for you.
 
#10
try using something like "sure delete" that program somehow overrides problems like "cant delete because its locked" its just the school bully of deleters, and its free. google it, i dont remember the site.
 

dadecamp

under worked, over paid
#13
doh...
After I ended task it just disappeared from C:\WINDOWS\system32\wins\
Where did it go and do i need to find it and delete it?
 
#14
Ensure any svchost.exe and dllhost.exe are not in C:\WINDOWS\system32\wins\ and your done for removing it.

Full details are on:

http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.html

The removal tool will remove the registry entires for you, now the files are gone you should be fine.

You need to install a firewall on your system asap to prevent further problems. Also you need the security patch from windows update however w32.welchia will probably have already applied this patch for you (it does that, how nice).
 

dadecamp

under worked, over paid
#15
I do have a svchost.exe in that folder but there are about 8 instances of a file with the same name in task manager. How do i get rid of it or will the removel tool take care of it?

By the way, thanks for all your help.. Its been invaluble.

Dave
 
#17
Regarding svchost.exe now the main process has gone this one should just be deleteable, the virus does not run it. Yes the removal tool will take care of it.

Regarding the firewall in PCC, no its not that good, very basic. I did not think much of it.

Checkout "Kerio 2.1.5". See the firewall poll and related theads in this section, have a dig around and a read :)
 

dadecamp

under worked, over paid
#18
Here is the results. Thanks again.

The service "RpcPatch" is viral. It is deleted.

The service "RpcTftpd" is viral. It is deleted.

The file "C:\WINDOWS\System32\wins\svchost.exe" is deleted.

W32.Welchia.Worm has been successfully removed
from your computer!

Here is the report:

The total number of the scanned files: 110517
The number of deleted files: 1
The number of repaired files: 0
The number of viral processes terminated: 0
The number of viral services deleted: 2
The number of registry entries fixed: 0
 

Members online

No members online now.

Latest posts

Latest profile posts

Perris Calderon wrote on Electronic Punk's profile.
Ep, glad to see you come back and tidy up...did want to ask a one day favor, I want to enhance my resume , was hoping you could make me administrator for a day, if so, take me right off since I won't be here to do anything, and don't know the slightest about the board, but it would be nice putting "served administrator osnn", if can do, THANKS

Been running around Quora lately, luv it there https://tinyurl.com/ycpxl
Electronic Punk wrote on Perris Calderon's profile.
All good still mate?
Hello, is there anybody in there? Just nod if you can hear me ...
Xie
What a long strange trip it's been. =)

Forum statistics

Threads
61,962
Messages
673,240
Members
89,018
Latest member
timpage