The Hindu Business Line : Removing worm

The system in my office runs on Windows 2000 platform and is infected by `welchia' worm. I downloaded the worm removal kit from Symantec, but the tool is unable to remove the worm either in normal mode or safe mode. Please tell me if I can remove the worm manually and also the steps that I must follow to do this.

V. Subbu

To do a manual removal of the worm, please follow the following steps

1) Update your virus definition files either by downloading the update files from the Web site of the corresponding anti-viral software you are using, or by using the live update software provided by the product.

2) Stop the worm services.

To do this, please follow these steps:

Click on start -{gt} settings -{gt} control panel -{gt} Administrative Tools -{gt} services, locate the following services and stop them.

·Network Connections Sharing

·WINS Client

3) You will also have to remove some registry keys. To do this, please Click Start - {gt} Run. Type regedit, then click OK. Navigate to the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Delete the subkeys:

RpcPatch and: RpcTftp

4) Then delete the Svchost.exe from the winnt\wins folder

You can get a detailed online report on this at the following Symantec site: http://securityresponse.symantec.

com/avcenter/venc/data/w32.