W32.Welchia.worm and dllhost.exe

  Neill 12:52 22 Oct 2003

Just downloaded Norton 2004 and when first run it says found the virus but cannot "repair" the dllhost.exe file. I've looked on PC Advisor and the previous replies re this virus and Norton and Microsoft web site. What I'd like to know is can I delete the dllhost.exe file without causing any problems. Thanks

  Jester2K II 12:54 22 Oct 2003

Yes it IS the virus click here

  temp003 13:09 22 Oct 2003

click here

Download the tool, read the instructions carefully (and disable System Restore if you use Windows XP), close all programs, disconnect from Restart. Run tool again to be sure.

Then go to Windows update to install the critical updates.

  Neill 13:13 22 Oct 2003

Is the easy answer just delete the file? This seems very complex. I'm a coward to try anything too complicated!

  steve0 13:33 22 Oct 2003

Do not just delete the file!!! Follow the instructions exactly - they work.

  Neill 13:34 22 Oct 2003

Fixwelch.exe didn't run first time so as per web we have restarted in Safe Mode, turned off System Restore and am now running FixWech.exe again. This by the way is being done on a friends PC and I am talking her through it, with your help, by phone.
Am now awaiting her next bulletin!

  Neill 13:36 22 Oct 2003

We haven't deleted the file, Yet!

  Xevious 13:51 22 Oct 2003

go in on safe mode, delete files under windows\system32\wins

only one of the files will delete (both svchost and dllhost in there are viruses)

but this won't solve the issue, you have 2 options:
1) follow instructions as per suggestions above
2) fiddle with the registry

as option 2 is not recommended if you don't know the registry, then it leaves you with option 1...

i found that stinger.exe works wonders. really easy to use, just execute it after downloading, and it'll do everything for you. if you want the util, click here

good luck!!!

  wags 13:56 22 Oct 2003

I caught the same bug (otherwise known as Nachi A) about 6 weeks ago and successfully got rid of it by following the Sophos instructions:

click here

  Neill 14:15 22 Oct 2003

We've done everything you've said: downloading the tool from Symantec, switching off System Restore and restarting in Safe mode then running the tool and all appears to have worked. Note for other users, you can't switch on System Restore whilst still in Safe Mode, so restart in normal mode then reapply the Sytem Restore.
I haven't tried Stinger but if I get the dreaded phone call from her later on to say the problem is still there we'll try that. Thanks for all your help. Neill

  Xevious 14:37 22 Oct 2003

stinger doesn't only look for the Welchi virus, but also does a good scan for a number of other big virus issues doing it's rounds. it's useful having the tool.

now that your PC is clean of the virus, ensure that you get the patch off the microsoft website which closes the port that the virus uses to get into your PC.



This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Samsung Galaxy A8 review: Hands-on

Illustrator Juan Esteban Rodriguez on creating highly detailed official film posters for Star Wars…

iMac Pro review

Quelle est la meilleure application de podcast pour Android (2018) ?