Your Ad Here Your Ad Here
Results 1 to 9 of 9

Thread: Virus Reappears After Windows Is Installed Again

  1. #1
    I've had this virus for quite a while DLLHOST.exe when i had it stuffed my antivirus programs and wouldn't let me reinstall it. I checked my registry it can't be found. But it kept blocking my in internet. So I reinstalled Windows xp and deleted my old windows folder (I don't wan't to format over my files). After install I get on the internet and my computer restarts for no reason, checked nothing in the registry still but I checked Windows Task Manager and DLLHOST.exe is in the process. Odd I have a clean windows install but the virus is still there. Why?

  2. Software & Hardware   -   #2
    Mr. Blunt's Avatar n00b
    Join Date
    Jul 2003
    Location
    Central California
    Age
    28
    Posts
    1,200
    Try downloading a patch to get rid of it. I don't think you needed to do a clean install of Windows. I just got rid of this worm a couple days ago. I downloaded the removal tool Symantec provides and I got rid of it perfectly. I provided a link for more information about this worm. There is a link to the removal tool download somewere on that page, just try looking for it.

    http://securityresponse.symantec.com/avcen...lchia.worm.html

  3. Software & Hardware   -   #3

  4. Software & Hardware   -   #4
    Hello all

    I too am trying to remove the same virus from my system. I did the search and found the files to be removed but i also discovered that there r 4 links for ControlSet. Should there be that many ControlSets in my registry?

    +ControlSet001
    +ControlSet002
    +ControlSet003
    +ControlSet
    (without any numbers)

    the question is do I remove "rpcpatch & tft pd" from 001 -003 as well or will it be removed automatically when done from ControlSet (without the numbers)

    - sorry still cannot copy the screen to give a better explanation
    Is this time for me to format my HDDm or is there an option before doing so

    Lanni

  5. Software & Hardware   -   #5
    Originally posted by KILskOOL@20 October 2003 - 18:52
    I've had this virus for quite a while DLLHOST.exe when i had it stuffed my antivirus programs and wouldn't let me reinstall it. I checked my registry it can't be found. But it kept blocking my in internet. So I reinstalled Windows xp and deleted my old windows folder (I don't wan't to format over my files). After install I get on the internet and my computer restarts for no reason, checked nothing in the registry still but I checked Windows Task Manager and DLLHOST.exe is in the process. Odd I have a clean windows install but the virus is still there. Why?
    Virus is in there because you didnt do a clean install.

    You did a dirty install.

  6. Software & Hardware   -   #6
    Originally posted by lanni@21 October 2003 - 02:42
    Hello all

    I too am trying to remove the same virus from my system. I did the search and found the files to be removed but i also discovered that there r 4 links for ControlSet. Should there be that many ControlSets in my registry?

    +ControlSet001
    +ControlSet002
    +ControlSet003
    +ControlSet
    (without any numbers)

    the question is do I remove "rpcpatch & tft pd" from 001 -003 as well or will it be removed automatically when done from ControlSet (without the numbers)

    - sorry still cannot copy the screen to give a better explanation
    Is this time for me to format my HDDm or is there an option before doing so

    Lanni
    If you really do have the same virus it can only be detected by this tool:-

    http://www.symantec.com/avcenter/FixWelch.exe

  7. Software & Hardware   -   #7
    checking again right now - any thoughts on Controlset001-003

    lanni

    Using that fix tool it deleted 2 viral services files

  8. Software & Hardware   -   #8
    sparsely's Avatar
    Join Date
    Dec 2002
    Location
    static hum
    Posts
    3,538
    Just backup your files on CD or something, and reformat.
    's what I'd do.

    this post is guaranteed 100% parrot-free

  9. Software & Hardware   -   #9
    Mr. Blunt's Avatar n00b
    Join Date
    Jul 2003
    Location
    Central California
    Age
    28
    Posts
    1,200
    If you read the page I gave everyone before, you wouldn't have to ask anymore questions.

    http://securityresponse.symantec.com/avcen...lchia.worm.html

    It was supposed to delete 2 viral services files.


    Creates the following services:

    Service Name: RpcTftpd
    Service Display Name: Network Connections Sharing
    Service Binary: %System%\wins\svchost.exe

    This service will be set to start manually.

    Service Name: RpcPatch
    Service Display Name: WINS Client
    Service Binary: %System%\wins\dllhost.exe

    This service will be set to start automatically.
    The worm creates these who services.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •