Tech Support > Computers & Technology > WORM_NACHI.A + variants
WORM_NACHI.A + variants
Posted by FeaolPlay on September 22nd, 2003


Anyone using Windows XP + PC-Cillin with latest pattern file and virus
definitions and seem to have immense uploading when connected to the
internet please read this:

http://www.trendmicro.com/vinfo/viru...e=WORM_NACHI.A

If you can't download any patches and PC-Cillin probrably won't be able to
clean, quarantine or delete the file (which usually arrives as DLLHOST.EXE)
you will have to manually remove it, then download the patch from Microsoft.
You cannot delete the file whilst in Windows beacause it will be detected as
currently being used.

To manually remove it please do the following:

Restart the PC and press F8 to go into boot menu, select "Safe mode with
Command Prompt" and press enter.
Once command prompt is loaded type in:

Then restart PC by pressing and holding Ctrl+Alt+Del to bring up task
manager. Click on Shutdown, > Restart.

When you have logged back onto Windows do another manual scan to make sure
the worm has not lingered or spread to any other folders. If you do find
any other folders where the worm has copied itself to, write down the
folder(s) and repeat the steps above.

Once there is an all clear from PC-Cillin you can go ahead and download the
latest patches from Microsoft.


If for any reason your Windows XP install has become corrupted from the
removal of the worm (which you shouldn't), then you will have to do a manual
repair:


set BEFORE the Hard Drive.
(If you are running an ASUS motherboard make sure the HDD is disabled from
the bootlist at first, then make sure you enable it after the first restart
from the Windows installation)
console.
After installation is complete and you arrive at the "Welcome User" setup
screen, ignore everything eg. internet setup Windows activation etc, except
for account names. Use the same name(s) you used for the first
installation. All previous internet accounts, Windows desktop settings,
Programs should be still the same after repairing also do not worry about
Windows Activation as it should still be activated, just click on remind me
later.


FP.




Similar Posts