Virus Found!

jhoop2002 · 04-November-03, 01:20 AM

No matter what i do, i keep getting this message from norton and then after i restart i get this annoying alarm sound from the pc speaker right when windows starts.

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: W32.Welchia.Worm
File: C:\System Volume Information\_restore{7A452E0B-25E5-4057-A99E-F0CF083B6D24}\RP6\A0004629.EXE
Location: Quarantine
Computer: COMPUTER-1
User: SYSTEM
Action taken: Quarantine succeeded : Access denied
Date found: Tuesday, November 04, 2003 1:49:24 AM

Right now i noticed that it says system volume information\_restore so i disabled system restore, how can i get this out of my system and keep it out?

Iateronmly · 04-November-03, 01:26 AM

http://securityresponse.symantec.com...oval.tool.html

Might work, don't know, never had it personally.

m3_tw0 · 04-November-03, 01:27 AM

http://securityresponse.symantec.com...oval.tool.html
That should get rid of that virus for you.

EDIT: Bah lat!!! you win this round lol

jhoop2002 · 04-November-03, 01:42 AM

i'll try it again, but how do i keep it from coming back? I ran this patch before and the virus found its way back onto the hard drive.

m3_tw0 · 04-November-03, 11:41 AM

Dont keep dlin viruses heh...update your nortons or whatever you use and just run it more often and becareful when downloading.

Maverick · 04-November-03, 11:49 AM

That virus is a strain of the blaster worm. Run the blaster worm patch and then run the removal tool for the virus. It should after that.

G Money · 04-November-03, 02:02 PM

I've had this at work and on a friend's computers so here is what you need to do. I'd do this for the blaster and welchia even though the welchia seems more prevelant. There is also a virus called GoBig which puts a restore point in the registry.

-Download the removal tool
-Reboot into safe mode
-Run removal tool
-Do full scan of hard drive
-Reboot into normal mode
-Do full scan of hard drive

-Go into your registry and look under System Restore for any files that have an .exe extension with an odd name. Like "A0394820.exe" or something like that ...also do a registry scan because some viruses put backup restores that put the virus right back on your machine. If you can, write down the name of the file that is in quaratine and do a search for that file name in your registry.

04-November-03, 01:20 AM		#1 (permalink)
jhoop2002 Apex Tech Maniac Supreme	Virus Found! No matter what i do, i keep getting this message from norton and then after i restart i get this annoying alarm sound from the pc speaker right when windows starts. Scan type: Realtime Protection Scan Event: Virus Found! Virus name: W32.Welchia.Worm File: C:\System Volume Information\_restore{7A452E0B-25E5-4057-A99E-F0CF083B6D24}\RP6\A0004629.EXE Location: Quarantine Computer: COMPUTER-1 User: SYSTEM Action taken: Quarantine succeeded : Access denied Date found: Tuesday, November 04, 2003 1:49:24 AM Right now i noticed that it says system volume information\_restore so i disabled system restore, how can i get this out of my system and keep it out?

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
First potential virus risk for Windows Vista found	michaelwolf59	PC Apex Press Releases	11	09-August-05 10:48 PM
Virus Alert: Worm exploits tsunami to spread virus	Lokie	PC Apex Web News	2	18-January-05 10:27 AM
The Register // Czech virus writer joins anti-virus firm	Gizmo	The Register RSS	0	09-November-04 02:06 AM
Think I found my car...	Darksamurai	Pimp Rides	43	28-March-04 01:43 AM
Virus Alert: The virus known as MyDoom	Lokie	PC Apex Web News	0	26-January-04 09:05 PM

04-November-03, 01:26 AM		#2 (permalink)
Iateronmly Smooth Operator	http://securityresponse.symantec.com...oval.tool.html Might work, don't know, never had it personally.

04-November-03, 01:27 AM		#3 (permalink)
m3_tw0 Apex Tech Fanatic Supreme	http://securityresponse.symantec.com...oval.tool.html That should get rid of that virus for you. EDIT: Bah lat!!! you win this round lol

04-November-03, 01:42 AM		#4 (permalink)
jhoop2002 Apex Tech Maniac Supreme	i'll try it again, but how do i keep it from coming back? I ran this patch before and the virus found its way back onto the hard drive.

04-November-03, 11:41 AM		#5 (permalink)
m3_tw0 Apex Tech Fanatic Supreme	Dont keep dlin viruses heh...update your nortons or whatever you use and just run it more often and becareful when downloading.

04-November-03, 11:49 AM		#6 (permalink)
Maverick Apex Elite Expert Tech	That virus is a strain of the blaster worm. Run the blaster worm patch and then run the removal tool for the virus. It should after that.

04-November-03, 02:02 PM		#7 (permalink)
G Money Fuel Hoe-lio	I've had this at work and on a friend's computers so here is what you need to do. I'd do this for the blaster and welchia even though the welchia seems more prevelant. There is also a virus called GoBig which puts a restore point in the registry. -Download the removal tool -Reboot into safe mode -Run removal tool -Do full scan of hard drive -Reboot into normal mode -Do full scan of hard drive -Go into your registry and look under System Restore for any files that have an .exe extension with an odd name. Like "A0394820.exe" or something like that ...also do a registry scan because some viruses put backup restores that put the virus right back on your machine. If you can, write down the name of the file that is in quaratine and do a search for that file name in your registry.