Nachi worm

[Steve]

McAffee told me this morning that C:\windows\system32
\wins\sychost.exe was infected with the afore-mentioned,
that it couldn't fix it and I should delete the thing and
get a clean copy. Anybody know how I can find such a beast?

[Sharon F]

On Fri, 29 Aug 2003 09:44:08 -0700, Steve wrote:

> McAffee told me this morning that C:\windows\system32
> \wins\sychost.exe was infected with the afore-mentioned,
> that it couldn't fix it and I should delete the thing and
> get a clean copy. Anybody know how I can find such a beast?

No need to get a replacement. That file is created by Nachi. See there
website for further information and cleanup directions.
--
Sharon F
MS-MVP/ Windows XP - Shell/User

[Sharon F]

On Fri, 29 Aug 2003 14:51:24 -0500, Sharon F wrote:

> On Fri, 29 Aug 2003 09:44:08 -0700, Steve wrote:
>
>> [4 quoted line(s) supressed]
>
> No need to get a replacement. That file is created by Nachi. See there
> website for further information and cleanup directions.

Oops, that last bit should read "see the McAfee website for further..."
Sorry.
--
Sharon F
MS-MVP/ Windows XP - Shell/User

[Gene K]

Symantec has a removal tool here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
Note this worm has several other names such as "welchia". Follow their
instructions carefully when using this removal tool. I believe Kaspersky
Labs also has a removal tool. I am surprised that McAfee does not.
Gene K

Steve wrote:
> McAffee told me this morning that C:\windows\system32
> \wins\sychost.exe was infected with the afore-mentioned,
> that it couldn't fix it and I should delete the thing and
> get a clean copy. Anybody know how I can find such a beast?

[Gene K]

Sharon,
Spell Check don't do everything that might be required, do you agree?

--
Gene

Sharon F wrote:
> On Fri, 29 Aug 2003 14:51:24 -0500, Sharon F wrote:
>
>> On Fri, 29 Aug 2003 09:44:08 -0700, Steve wrote:
>>
>>> [4 quoted line(s) supressed]
>>
>> No need to get a replacement. That file is created by Nachi. See
>> there website for further information and cleanup directions.
>
> Oops, that last bit should read "see the McAfee website for
> further..." Sorry.
> --
> Sharon F
> MS-MVP/ Windows XP - Shell/User

[Sharon F]

On Fri, 29 Aug 2003 21:33:01 -0400, Gene K wrote:

> Sharon,
> Spell Check don't do everything that might be required, do you agree?

Obviously, I agree! :)
Take care,

--
Sharon F
MS-MVP/ Windows XP - Shell/User