Nachi virus

[cash2526]

I "obtained" the nachi virus (a variation of MSBlast) and have since gotten rid of it with avg 6.0. But i still get a message every so often that says the Nachi virus has been detected and i must run avg to get rid of it. I did so and it did not detect anyting. So i need to get rid of that message. I think i must in stall some security updates/patches. So im going to try that and i will replie back when i reach a verdict.

 

[cash2526]

I have downloaded all of the patches and still i get the message.

 

[Rapmaster]

Try this utility to remove it (from the makers of McAfee) :

http://vil.nai.com/vil/stinger/

AVG isn't very good at removing things but it does manage to detect them.

 

[cash2526]

thanks alot

I used stinger and it did find and kill my virus. If he rears his head again ill be sure to post it.

(Good by AVG)

 

[cash2526]

Now every so ofter i get a message that says (program) has detected the nachi virus in C:\System Volume Information\(alot of code). It first did this with AVG so i uninstalled it (thinking that Stinger got rid of it) and intalled Norton Anti-Virus 2001 and then i updated every thing. Now it calls it its other name welchia or something and says that it cannot repair the file and it cant get accesss to the file. I have no idea what to do next.

 

[Rapmaster]

here's another tool:

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

Pay attention the part about disabling System Restore because I think that's your problem

 

[cash2526]

I havent used that utility yet but i was just reading up on the virus and it said that the virus is a Memory Resident and it stays in DOS after deleted. I dont think that Windows XP has DOS but im sure that some part of my system still could have it.

 

[Wargasm]

not familliar with this virus .
could try to bootup with a win98 bootup disk and see if there is a dos removal tool .

i doubt the command prompt will work here.

 

[Unregistered]

Try going to Trend Micro's web site. They give detailed instructions on how to remove this virus. Here is the site

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_NACHI.A