Worm_msblaster.d

dadecamp

under worked, over paid
Joined
30 Apr 2004
Messages
123
My virus scanner, PC-Cillin, has found this in:
C:\WINDOWS\system32\wins\DLLHOST.EXE

How do I get rid of it? Virus scanner can't delete it.
 
I ran the newest ver. 1.0.6.1 but it didn't detect or clean it. What command line tool do i use?
 
Edited my post, i spotted the process name ;) Run the commands above and see how you do.
 
I didn't see your edit. Be right back after doing as told.
 
Nothing found :
W32.Blaster.Worm has not been found on your computer.

My virus scanner still says its there.
What next?
 
Run "TASKKILL /IM dllhost.exe" (or open the task manager and kill the process) then open up C:\WINDOWS\system32\wins\ and delete the file.

Its not Blaster, its welchia :)
 
Open task manager and on the process tab find dllhost.exe, right click and hit end process (that may come back access denied to but try ir) then delete it.

Can't belive PC-Cillin wont remove it for you.
 
try using something like "sure delete" that program somehow overrides problems like "cant delete because its locked" its just the school bully of deleters, and its free. google it, i dont remember the site.
 
doh...
After I ended task it just disappeared from C:\WINDOWS\system32\wins\
Where did it go and do i need to find it and delete it?
 
Ensure any svchost.exe and dllhost.exe are not in C:\WINDOWS\system32\wins\ and your done for removing it.

Full details are on:

http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.html

The removal tool will remove the registry entires for you, now the files are gone you should be fine.

You need to install a firewall on your system asap to prevent further problems. Also you need the security patch from windows update however w32.welchia will probably have already applied this patch for you (it does that, how nice).
 
I do have a svchost.exe in that folder but there are about 8 instances of a file with the same name in task manager. How do i get rid of it or will the removel tool take care of it?

By the way, thanks for all your help.. Its been invaluble.

Dave
 
Regarding svchost.exe now the main process has gone this one should just be deleteable, the virus does not run it. Yes the removal tool will take care of it.

Regarding the firewall in PCC, no its not that good, very basic. I did not think much of it.

Checkout "Kerio 2.1.5". See the firewall poll and related theads in this section, have a dig around and a read :)
 
Here is the results. Thanks again.

The service "RpcPatch" is viral. It is deleted.

The service "RpcTftpd" is viral. It is deleted.

The file "C:\WINDOWS\System32\wins\svchost.exe" is deleted.

W32.Welchia.Worm has been successfully removed
from your computer!

Here is the report:

The total number of the scanned files: 110517
The number of deleted files: 1
The number of repaired files: 0
The number of viral processes terminated: 0
The number of viral services deleted: 2
The number of registry entries fixed: 0
 

Members online

No members online now.

Latest profile posts

Also Hi EP and people. I found this place again while looking through a oooollllllldddd backup. I have filled over 10TB and was looking at my collection of antiques. Any bids on the 500Mhz Win 95 fix?
Any of the SP crew still out there?
Xie wrote on Electronic Punk's profile.
Impressed you have kept this alive this long EP! So many sites have come and gone. :(

Just did some crude math and I apparently joined almost 18yrs ago, how is that possible???
hello peeps... is been some time since i last came here.
Electronic Punk wrote on Sazar's profile.
Rest in peace my friend, been trying to find you and finally did in the worst way imaginable.

Forum statistics

Threads
62,015
Messages
673,494
Members
5,621
Latest member
naeemsafi
Back