I have a w32.welchia.b.worm in my computer, does anyone know...

<< Back to: [alt.comp.virus] FAQ Part 1/4

Answer by LamerX
Submitted on 3/1/2004
Rating:	Rate this answer:
I run an XP-machine and have the Welchia.B.Worm. I've tried the Norton removal tool as well as "manual" deletion through safe mode Norton scanning to no effect. Have identified some of the virus locations (temporary internet files\Content.IE5), typically WksPatch[1].exe, WksPatch[2].exe,... WksPatch[4].exe, etc but as I try to put them in quarantine the following merror message shows: "Error adding file to quarantine. This file may be in use by another process or you may be out of disc space" Wtf? So is my computer protecting the virus files? What to do? Note: Strange thing is that though Norton (as well as trendmicro) seems totally blind to the presence of the virus(es) when system scan is made, Symantec Auto-Protect frequently reports on the virus as being identified but "unable to repair" the file. Norton schizophrenic?

Answer by Robbie
Submitted on 3/3/2004
Rating:	Rate this answer:
You must go into your virus protection folder and delete anything being held in quarantine. Then do the system restore stuff and run the removal tool and then There is one thing you must do that is not listed in the removal directions. (It seems long but you just have to open many folders to get to the one with the virus still in it.)Here goes: right click on start button and click on "explore", double click on the "c drive", double click on "windows", double click on "system 32, double click on "config", double click on "system profile", double click on "local settings" (if you don't see it, click on "tools", select "folder options", select "view", and click in the box that says to show all hidden folders), double click on "temp internet files", double click on "content.IE5". You will see 4 folders. You must open each of these folders and delete any file called "wkspatch". Then empty your trash and restart your computer. I was having no luck removing this virus until I did this. It hasn't failed yet.

Answer by YK
Submitted on 3/8/2004
Rating:	Rate this answer:
I was having the same Welchia.B/Nachi.B problem, and I couldn't remove it with any removal tool or by the regular manual way, but I found a way to remove the whole worm from the computer (it's a little long..): First you have to get and apply the microsoft "vulenerability patches" found here: 1.http://www.microsoft.com/technet/security/bulletin/MS03-007.asp 2.http://www.microsoft.com/technet/security/bulletin/MS03-026.asp Then download the "Avast! Cleaner" from http://www.avast.com/i_idt_171.html And download & install Ad-Aware 6 with the newest update ("reference file"), if you don't already have it, from http://www.lavasoft.de/default.shtml.en OK, now turn off system restore, and reboot in Safe Mode. Then delete all the files found in the 4 folders in C:\WINDOWS1\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5 Then run the Avast! Cleaner- this should delete the svchost file the worm created. And do a scan with Ad-Aware and delete the Registry keys of Welchia.B that Ad-Aware found (It may also find other Spyware that you might want to delete). OK, now reboot your computer, turn on system restore, and... that's it! (I used this method and it worked, so I hope it works for you too)

Answer by Lola
Submitted on 3/10/2004
Rating: Not yet rated	Rate this answer:
Norton just gave me the notification once again, i'm this <> close to giving up, its been 3 days now. I can't find the svchost file in my system32/drivers but there's the "good" one in system32. I've started my computer in safe mode, turned off the restore, ran the symantec tool a billion times with the same result...NOTHING FOUND. but yet the notification comes up minutes later, and norton quarentines it, i delete it. check the 4 folders in content IE5, find nothing in all 4 of them. come here and try EVERY suggestion given by you guys, and still the notice comes. I don't know what else to do. I've downloaded the patches but, i don't know if they've installed because the comp freezes. Does anyone else have an suggestions for me? i'm really desperate. but please don't tell me to use the symantec tool again b/c that doesn't work for my system. because i have the welchia.b.worm but it only searches for the welchia.worm. But that's about it. Thanks for reading ):/:)

Answer by mortisha
Submitted on 3/12/2004
Rating:	Rate this answer:
Just Like To say a big thank you to YK for his posting , I followed his advise and it got rid of the NASTY virus first time round.I made sure i downloaded all the links turned off system restore and started in safe mode removed the virus ,ran the virus prog, ran adaware etc .then rebooted and ran norton {updated Definitions} HAY PRESTO no more nasty virus .I think a lot of you are failing to go into safe mode when searching for the virus,which will obviously cause you problems .Make sure your in safe mode and do all of YK's advice in there{F8 at bootup = safemode} Cant Thank YK Enough for the advice .Cheers your a Very Nice Person.To all you virus writers out there why dont you all get together and do something constructive with your computer skills like write a virus proof operating system instead of causing the rest of the population so much hassle ??????

Answer by mebl
Submitted on 3/17/2004
Rating: Not yet rated	Rate this answer:
Well, I finally got rid of the virus. However, I didn't have any wkspatch files. I deleted the all the files and folders in the C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\ folder as suggested by YK and did it in safe mode. Also, I already had the patches installed. If u get the NT/Auth shutdown dialog, just click Start > Run > cmd > Enter key and type shutdown -a to stop the shutdown. After deleting the files I fdisked the drive again and reformatted my partitions. This time I noticed that I was unable to delete the extended partition for some odd reason, but after created the new partitions, everything was fine. One thing I noticed when I first installed XP is that the install was different then the normal install and asked different questions. I think this was due to the virus already being there when the drive had win98se. This virus doesn't do anything on win98se. After getting rid of the virus, the install went normal without the different question screens. People having problems with the Nachi.B virus should follow YK's suggestion. Make sure the patch is installed and u r in safemode with the system restore turned off. Press F8 while booting to get to safemode. r-click My Computer > properties > System Restore Tab > put a check in Turn off Sytem Restore on all drives. (don't forget to turn restore back on after the reboot once the virus is for sure gone.

Answer by YK
Submitted on 3/26/2004
Rating:	Rate this answer:
Hi all, I'm glad my advice worked for alot of you (: snail, to download the patches go to the websites I mentioned, and then under "General Information" click "Patch availability", then choose your operating system, see Dany's answer about whether you have a 32 or 64 bit system, and download the patch. Then run the patches and follow the instructions to apply them. FedUp, you should delete all the files in all of the folders that are in Temporary Internet Files. I'm not sure if they are all related to the worm, but they are all "temporary" internet files that the computer doesn't need, so it would be safer to delete them all, just in case they are related. About the svchost file that's located in the Windows/system32 folder- it's not related to the worm (only the one in Windows\system32\drivers) and it's a process that Windows needs, so it shouldn't be deleted. Hope this helps! YK

Answer by Bec
Submitted on 4/20/2004
Rating: Not yet rated	Rate this answer:
Ok guys, I don't know what I did wrong. I followed everyone's suggestions about patches, rebooting in safe mode, shutting off system restore, deleting the wkspatch[1] file. I even installed Avast etc. Nothing worked. Eventually, I used task manager to end the processes of all the svchost's that kept popping up, then managed to delete it. Now my computer is deceased. It will start up in normal mode, but you can't run any programs. I tried to restore svchost from the recycle bin, but it won't let me. It won't even let me cut and paste it from the recycle bin, or even a floppy disk. I'm out of ideas. Is there anything I can do to get my computer running again without having to reinstall windowns???

Answer by chris
Submitted on 5/2/2004
Rating: Not yet rated	Rate this answer:
I need help I dicovered the worm a while ago now and i tried everything to get rid of it. I have Norton, Spy bot search and destroy, ad aware 6 and Avast cleaner and none of them have found and removed the worm. I followed Jk's advice and Robbies also, i delested the files in the temp. interent folder and emptied my quartine, i thought it was over... it wasnt. Norton popped up the next day saying that i had the worm again but was unable to delete the files. This happened twice in a row, after the second alert Norton again popped up and said that Norton has deleted the worm from your computer, im think that is weird.... This happens every time i tunr my computer on. Can some one plze help me?

Answer by dave
Submitted on 8/29/2006
Rating: Not yet rated	Rate this answer:
hey all, i have an error that comes up saying svchost error the memory at 0007894a is not referenced at 00000000, when i click ok a rfc shutdown screen appears and gives me 60 seconds to save work and shuts down, (i can get rid of this by typing shutdown -a in the run window. i have tried downloading loads of programs to get rid of the worm but i cant seem to find any that work-if i try and do a windows update it wont allow me access their site it just blocks me. i think that the virus has come in through the f-secure software i was using as anytime i try and access it it says its unavailable, so i tried to unistall it but it wont allow me, this has been going on for a week now and i cant find and fix- would any of ye have experienced this problem before and if so how would i fix it.. cheers dave

Answer by Kristjan ( janucrio@yahoo.co.uk )
Submitted on 11/21/2006
Rating: Not yet rated	Rate this answer:
i had this worm coming yesterday, my AD-Aware SE had found it thi skind of worm don´t remember it´s proper name. there wre two files and they were removed after that i also used my newly updated Spybot Search and Destroy as well it found nothing. but the worst is 1: The ask manager doesn´t show up if i press CTRL-ALT-DEL 2: I´ve also tried to right click on the taskbar and choose Task Manager but nothing happens 3: I´ve downlaoded a removal tool from Symantec homepage but it didn´t work I know it outh there have tried all advices i´ve read here but nohting works when i try to find the mentioned file in the C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SXY3S1IJ\WksPatch[1].exe adress But it´s empty in all corners, but i know it´s out there. I´ve only had this since the summer, am an 19 year old boy attending at a middle school am am using this Compag Presario V5000 for schoolwork and have many programs but my dad says that the only thing that he vould do is to completely re-install the Win-XP system but i don´t want that to happen. So if anybody can help me then please respond

FAQS.ORG makes no guarantees as to the accuracy of the posts. Each post is the personal opinion of the poster. These posts are not intended to substitute for medical, tax, legal, investment, accounting, or other professional advice. FAQS.ORG does not endorse any opinion or any product or service mentioned mentioned in these posts.

<< Back to: [alt.comp.virus] FAQ Part 1/4

[ Home | FAQ-Related Q&As | General Q&As | Answered Questions ]

Question by Jenster
Submitted on 2/23/2004
Related FAQ: [alt.comp.virus] FAQ Part 1/4
Rating:	Rate this question:
I have a w32.welchia.b.worm in my computer, does anyone know how i can get rid of it? i've tried downloading the patch software but it wont come through! thanks.

Answer by VIRUS HUNTER
Submitted on 2/26/2004
Rating:	Rate this answer:
GOTO WWW.NORTON.COM AND GET REMOVAL TOOL.

Answer by bebe
Submitted on 2/29/2004
Rating:	Rate this answer:
i have a W32.welchia.B.worm on my computer how do i get rid of it????/

Answer by Mandinha
Submitted on 3/2/2004
Rating: Not yet rated	Rate this answer:
I also have Welchia in my computer, and as LamerX, I can´t get rid of them!! Yes, I turned off the system restore, passed the tool, I made everything I could do...and my Symantec Auto-Protect continues reporting me the presence of the virus, I see the files WksPatch but I can´t do anything. What can I, better, What can we do? If somebody knows it, please answer.

Answer by cannavjj
Submitted on 3/5/2004
Rating:	Rate this answer:
Robbie's answer worked. I deleted all the folders. As for slimjimmy11, try restarting in Safe Mode & then delete.

Answer by klasse
Submitted on 3/1/2004
Rating: Not yet rated	Rate this answer:
Did you turn off system restore, maybe thats why it is still there?

Answer by LindaKay
Submitted on 3/3/2004
Rating:	Rate this answer:
I am having same issue. Norton will quarantine the files (wkspatch, svchost) and I can delete them or clean with Symantec removal tool but the virus files keeping showing back up. I have also tried AdWare 6.0 and Spybot. Nothing seems to completely clean the virus. I have been recommended to rebuild my laptop...yuck! If someone knows how to clean please let me know.

Answer by arggggh
Submitted on 3/3/2004
Rating: Not yet rated	Rate this answer:
me too; i am also having the same symptoms (tried to manually remove, turned off system restore, virus keeps coming back) and it is causing quite a bit of system instability. I'm pulling my hair out trying to get it off. please... please someone help

Answer by slimjimmy11
Submitted on 3/3/2004
Rating: Not yet rated	Rate this answer:
Hi all, I'm having the same problem as all of you are having. Robbie, I tried everything you said to do and found the 4 folders with "wkspatch" files in them. However, I'm not able to delete the files. It says the file is being used by another person or program. Is there a way to get around this? Thanks.

Answer by slimjimmy11
Submitted on 3/6/2004
Rating: Not yet rated	Rate this answer:
Hi again, It's the weirdest thing. I went into the folders and deleted the wkspatch files. I went into safe mode and ran the system scan and the welchia removal tool. They didn't find anything. So I thought I was in the clear. But an hour ago, the auto protect popped up again and told me I still have the virus. WTF? Is anybody out there experiencing the same thing?

Answer by heavn01
Submitted on 3/6/2004
Rating: Not yet rated	Rate this answer:
Ya, I clean out all the patch files from my config folder and pass the removal tool and virus scan and when i restart my computer it seems to be okay at first. Then an hour later I get that message from my norton antivirus saying that i have the worm again. It keeps showing up and I can't seem to completely remove it!

Answer by johan
Submitted on 3/6/2004
Rating: Not yet rated	Rate this answer:
is the removaltool the same for the W32.welchia.B.Worm as for the W32.welchia.Worm ???? if so it seemes impossible to get this out of the system. i'vetried it all!!!

Answer by M.
Submitted on 3/7/2004
Rating: Not yet rated	Rate this answer:
"It says the file is being used by another person or program." You need to end the process. Pres cntrl+alt+del, click on the tab that says "process" (depending on your version of windows, you may have to hit "task manager" first.) Look for a file in there called WksPatch.exe and click 'end process'. Then try deleting the files again.

Answer by jill
Submitted on 3/7/2004
Rating: Not yet rated	Rate this answer:
ok i am getting really fusterated i can't do anything to get rid of this worm.I reformatt it comes right back up, it dosn'tactually infect anything because norton removes it but i have to restart the computer because programs don't respond.I don't even know why i am getting this.SOMEONE please help

Answer by G.L.06
Submitted on 3/8/2004
Rating: Not yet rated	Rate this answer:
I'm having the same problem as the rest of you.I'm new with computers and am finding this very discuraging,I can't even hook my new printer up because of it, any help would be greatly appreciated.

Answer by Karin
Submitted on 3/11/2004
Rating:	Rate this answer:
ROBBIE= IN YOUR INSTUCTIONS I FOLLOWED EVERYTHING UP UNTIL SYSTEM PROFILE BUT THEN I DIDNT HAVE A LOCAL SETTINGS. PLEASE HELP I AM IN SUCH NEED OF HELP.

Answer by Scott
Submitted on 3/8/2004
Rating: Not yet rated	Rate this answer:
I had the worm as well. All I did was make sure I had all of the recommended and critical windows update files. I then followed everything YK said. I found that having those update files did the trick.

Answer by Jill
Submitted on 3/9/2004
Rating: Not yet rated	Rate this answer:
thx Robbie, i downloaded the patch a day ago and the worm hasn't come up since :)....i recommend to everyone to download the patch for it, it works

Answer by Sang
Submitted on 3/9/2004
Rating:	Rate this answer:
1. delete WksPatch[1].exe in C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SXY3S1IJ\WksPatch[1].exe 2. delete SVCHOST.EXE in C:\WINDOWS\SYSTEM32\DRIVERS\SVCHOST.EXE (12,800 bytes) I think things mentioned above will work in most cases. More information is in this site. http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101025 http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html Good luck! Actually, I spent lot of time to get rid of this worm.

Answer by Rob
Submitted on 3/10/2004
Rating: Not yet rated	Rate this answer:
Delete the svchost.exe file. This is where the wkspatches are made from. There is a good copy of svchost.exe in your system 32 file. you can't delete this. you have to go into the drivers file in the system 32 folder. then delete svchost.exe. If you are unable to, restart in safe mode and try it. hope it helps.

Answer by ET
Submitted on 3/11/2004
Rating: Not yet rated	Rate this answer:
I'm having the same problems removing the w32.welchia.b worm from my computer running windows xp. I also cannot download anything without getting a notification about this worm and I cannot download windows updates since I've had this virus. Can anyone help?

Answer by Dolfy
Submitted on 3/11/2004
Rating: Not yet rated	Rate this answer:
I followed the process that YK indicated and I think that I got rid of the virus. At least it does not show up again in any of the scannings. The problem that originally make me think that I may have a bug was that as soon as I connected with the internet, everything was SO slow…sometimes it would not even connect with my server (phone). Even though it seems that I got rid of the virus, I am still having the same problem. Can anybody help me to know what to do next? PS There was an INDEX file with the folders in “content.IE5” that I did not delete. Should I have deleted it? THANKS TO ALL. Dolfy

Answer by jake36
Submitted on 3/11/2004
Rating: Not yet rated	Rate this answer:
If you have a compaq or Hp there is a second partition on your hard drive. Check to see if the files are on that drive also, and try running the tool on the second partition too

Answer by superluvrgurl
Submitted on 3/12/2004
Rating: Not yet rated	Rate this answer:
i also have this stupid worm thingy. I have tried deleting the files but it won't let me! this is really getting aggrivating. I called the support center for my computer and they told me to do a destructive recovery but im gonna loose everything if I do that! HELP!!!!!!!!!!!!!!

Answer by Ozzie
Submitted on 3/12/2004
Rating: Not yet rated	Rate this answer:
I ran a full format with fdisk/MBR and i still have that damn thing?????????\go figure AARRAAAAGHHHHHHHHH!!!!!!!! I will try the above steps now i guess,never thought it would stil be around AFTER fdisk/mbr.

Answer by naz
Submitted on 3/13/2004
Rating: Not yet rated	Rate this answer:
plz help me get rid of the welchia worm!

Answer by Simon
Submitted on 3/14/2004
Rating: Not yet rated	Rate this answer:
Download and install WindowsXP-KB824146-x86-ENU.exe and follow YK instructions

Answer by OldTack
Submitted on 3/15/2004
Rating: Not yet rated	Rate this answer:
Just like to say thx to YK, was having a complete nightmare with this on, formatted my hdd 3 times(was doing it anyway) but kept getting the worm everytime i logged on the net to update norton, followed your advise to the tee and all seems well(apart from my brain which spent far too long on this one) thx again Tack

Answer by Titan
Submitted on 3/15/2004
Rating: Not yet rated	Rate this answer:
Oh God! Everything i see here were tried but still not helping at all! What am i supposed to do??? Sigh.... CURSE THE CREATOR

Answer by mebl
Submitted on 3/16/2004
Rating: Not yet rated	Rate this answer:
This virus must place something in the mbr or boot sector because I have repartitioned the drive several times and even ran western digital's utility to zero fill, but the virus still comes back after the install. I know the installation disk doesn't have the virus cause I used it on another computer and that computer doesn't have this virus. I enabled the bios virus protection but it has not alerted once during the partioning or the complete winxp install. The only thing I can try next is to fix the mbr. I hope someone out there comes up with a fix soon cause this virus is really irritating!

Answer by donna
Submitted on 3/16/2004
Rating: Not yet rated	Rate this answer:
find svchost.exe using computer search. Enter '.exe' for file name, 'svchost' in 'words containing etc'..it doesn't show up otherwise. I've just deleted it sucessfully..if it comes back again I'll do what yk said

Answer by BG
Submitted on 3/21/2004
Rating: Not yet rated	Rate this answer:
I had the W32.Welchia.B Worm and followed Robbie's advice above - it worked perfectly - Thanks Robbie. Remember to empty the wase bin and then get the Microsoft Patches to stop it happening again.

Answer by pablo
Submitted on 3/21/2004
Rating: Not yet rated	Rate this answer:
hey. I am just wondering how to get rid of the svchost file in the system32 file. I can't delete it even in safe mode. I am desperate. I have followed most of the instructions posted here, the only thing left is the svchost file. Any suggestions? God bless you!!

Answer by Toriyama
Submitted on 3/22/2004
Rating: Not yet rated	Rate this answer:
For all those who have had problems deleting the files till now: Nortan AntiVirus has a buildin del tool ("Whipe out", under additional tools) which can delete the files without any problems.

Answer by Tom
Submitted on 3/22/2004
Rating: Not yet rated	Rate this answer:
I have a dell computer running xp..I need help in destroying this worm.W32.welchia.b.worm. Can someone walk me through the process. Where did this worm orginate from. Also if I remember correctly there was a notice telling me that this worm would automatically remove itself maybe in June 2004. Does this sound familiar? Thank you.

Answer by Dany
Submitted on 3/23/2004
Rating: Not yet rated	Rate this answer:
Finally i kill the virus! Thank's to all for the help! I do so: i follow step by step the YK answer, but the virus come back, so i went to "Tools" - "Windows Update" on the explorer bar and i made ALL the important upgrade listed here. Than...it's a week that the virus don't pop up!!! P.S For Titan, if you have an Intel processor you have the 32 bit system. The 64 bit is only in some AMD processor.