NAV 2003, Win XP, HP Pavilion 724c PC

[dddave]

A friend has the subject PC. After 4 hours of work, continue to have problems with the PC freezing as a result of the W32.welchia.worm. He had registered his NAV 2003 with a 1-yr subscription, but due to a system freeze, was unaware that NAV was not updated and the infection probably occurred in the last 1 1/2 months. We updated the PC to the latest scan; we then ran a hard drive scan and the virus (worm) infection was indicated and the scan of the remainder of the hard disk ceased. MSIE freezes shortly after the Virus Alert signifies the worm is present. I tried to run a Windows update, and the PC froze before we could get a readout on what was needed to update the OS. (His wife noted that the freeze had previosly occurred whenever she was attempting to send e-mails or access the Internet via the browser; at that time there were no Virus Alerts from NAV.) The worm has infected dllhost.exe in C:\Windows\System32\wins folder. They cannot send e-mails - they use Earthlink. We cannot download the w32.welchia.worm removal tool from the Symantec site, as MSIE freezes.
What could the next step be?
Thanks,
David

 

[karmic]

The removal tool is only 172 kb in size, can you download the tool at someone else's pc and copy it to diskette?
If you can, boot the system into safe mode and run the tool.

Something else to try only "IF" you are familiar with the registry.

Click start, click run, type regedit, press enter.
Navigate to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
In that list there is a key (folder) called Run. Rename Run to RunBackup. Close the registry down and reboot the system. This will give you a clean bootup for the most part.

Try to download the tool again.

If you are not comfortable doing this, don't.

Good luck

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[dddave]

I downloaded the w32.welchia.worm removal tool. We restarted his PC into safe mode and ran the removal tool from a 1.44 MB floppy. The tool's results were for 65,451 files, 2 deleted viral services files and 1 registry entry fixed. We logged on with Earthlink a number of times and perused sites; they also downloaded mail with good results. We updated NAV and scanned the two hard disks, C and D (189,221 files), and there were no infections observed. We defragged C (NTFS configuration) and that went well. D is a recovery disc (FAT 32) and we did not defrag that. We downloaded ZoneLabs (free), which would not install on C.
Thanks for your assist.
David