Welchia Worm - Whats this.jpg (0/1)

[zaskar]

Recently I was infected with the welchia worm.
I found and used fixwelch.exe from symantec.
Everything went ok, It found the worm and deleted it.
However, now when I use IE or Opera my firewall (Kerio) indicates I
have several copies of it running see the pic, 4 Operas and 2 IE's one
connected to a strange address, Both were connected to google
I have read that maybe I should have deleted 'svchost.exe' but since
this is a windows component in use I cannot.
I'm asking here before more drastic measures are used.
Can I do a repair on the system files using the Windows XP pro disk?
Help really apreciated.

[Mike Brannigan [MSFT]]

"zaskar" > wrote in message
...
> Recently I was infected with the welchia worm.
> I found and used fixwelch.exe from symantec.
> Everything went ok, It found the worm and deleted it.
> However, now when I use IE or Opera my firewall (Kerio) indicates I
> have several copies of it running see the pic, 4 Operas and 2 IE's one
> connected to a strange address, Both were connected to google
> I have read that maybe I should have deleted 'svchost.exe' but since
> this is a windows component in use I cannot.

Do not delete svchost.exe it is used by a number of core Windows
components.
--
Regards,

Mike
--
Mike Brannigan [Microsoft]

This posting is provided "AS IS" with no warranties, and confers no
rights

Please note I cannot respond to e-mailed questions, please use these
newsgroups

"zaskar" > wrote in message
...
> Recently I was infected with the welchia worm.
> I found and used fixwelch.exe from symantec.
> Everything went ok, It found the worm and deleted it.
> However, now when I use IE or Opera my firewall (Kerio) indicates I
> have several copies of it running see the pic, 4 Operas and 2 IE's one
> connected to a strange address, Both were connected to google
> I have read that maybe I should have deleted 'svchost.exe' but since
> this is a windows component in use I cannot.
> I'm asking here before more drastic measures are used.
> Can I do a repair on the system files using the Windows XP pro disk?
> Help really apreciated.

[zaskar]

On Thu, 21 Aug 2003 12:54:57 +0100, "Mike Brannigan [MSFT]"
> wrote:

>"zaskar" > wrote in message
...
>> Recently I was infected with the welchia worm.
>> I found and used fixwelch.exe from symantec.
>> Everything went ok, It found the worm and deleted it.
>> However, now when I use IE or Opera my firewall (Kerio) indicates I
>> have several copies of it running see the pic, 4 Operas and 2 IE's one
>> connected to a strange address, Both were connected to google
>> I have read that maybe I should have deleted 'svchost.exe' but since
>> this is a windows component in use I cannot.
>
>Do not delete svchost.exe it is used by a number of core Windows
>components.
>--
>Regards,
>
>Mike
Thanks Mike
This is baffling me, Suppose I launch Internet explorer, it goes to
google (my home page) but my firewall reports 2 Internet explorer
connections one at google and another it cant resolve.

[Russ]

Can you empty\delete the programs your firewall is
allowing? I have had this problem also and I deleted all
the programs that I\were allowed by my firewall(Norton),
It solved the confusion. As far as home page for IE, just
set a page of your choosing for it.
>-----Original Message-----
>On Thu, 21 Aug 2003 12:54:57 +0100, "Mike Brannigan
[MSFT]"
> wrote:
>
>>"zaskar" > wrote in message
...
>>> Recently I was infected with the welchia worm.
>>> I found and used fixwelch.exe from symantec.
>>> Everything went ok, It found the worm and deleted it.
>>> However, now when I use IE or Opera my firewall
(Kerio) indicates I
>>> have several copies of it running see the pic, 4
Operas and 2 IE's one
>>> connected to a strange address, Both were connected
to google
>>> I have read that maybe I should have
deleted 'svchost.exe' but since
>>> this is a windows component in use I cannot.
>>
>>Do not delete svchost.exe it is used by a number of
core Windows
>>components.
>>--
>>Regards,
>>
>>Mike
>Thanks Mike
>This is baffling me, Suppose I launch Internet explorer,
it goes to
>google (my home page) but my firewall reports 2 Internet
explorer
>connections one at google and another it cant resolve.
>.
>

[zaskar]

I uninstalled Kerio firewall 2.14 and installed 2.15 (the latest) and
am still getting this problem.
When I set up the firewall preferences for 2.15 internet explorer
wanted '2 rules' which seemed strange as all my other programs only
need one rule.
On Thu, 21 Aug 2003 08:42:05 -0700, "Russ" > wrote:

>Can you empty\delete the programs your firewall is
>allowing? I have had this problem also and I deleted all
>the programs that I\were allowed by my firewall(Norton),
>It solved the confusion. As far as home page for IE, just
>set a page of your choosing for it.
>>-----Original Message-----
>>On Thu, 21 Aug 2003 12:54:57 +0100, "Mike Brannigan
>[MSFT]"
> wrote:
>>
>>>"zaskar" > wrote in message
...
>>>> Recently I was infected with the welchia worm.
>>>> I found and used fixwelch.exe from symantec.
>>>> Everything went ok, It found the worm and deleted it.
>>>> However, now when I use IE or Opera my firewall
>(Kerio) indicates I
>>>> have several copies of it running see the pic, 4
>Operas and 2 IE's one
>>>> connected to a strange address, Both were connected
>to google
>>>> I have read that maybe I should have
>deleted 'svchost.exe' but since
>>>> this is a windows component in use I cannot.
>>>
>>>Do not delete svchost.exe it is used by a number of
>core Windows
>>>components.
>>>--
>>>Regards,
>>>
>>>Mike
>>Thanks Mike
>>This is baffling me, Suppose I launch Internet explorer,
>it goes to
>>google (my home page) but my firewall reports 2 Internet
>explorer
>>connections one at google and another it cant resolve.
>>.
>>