I know that I have a virus/worm (at least one!!). I started getting the RPC error whereby the computer shuts down in 60 seconds. I ran the Welchfix by Symantec and it indicated that it found and deleted the worm. The files it indicated it deleted were:
Rpcpatch is viral – it is deleted
Service rpctftpd is viral – it is deleted
Tool has deleted file c:\windows\system32\wins\dllhost.exe
Tool has deleted file c:\windows\system32\wins\svchost.exe

Then indicates W32.welcia.worm has been successfully removed. When I dial a connection to the internet, I get the rpc error again and it shuts down. Then each and every time I run Welchfix again – it finds and deletes the worm. Am I getting it back each time I dial in? I am trying to connect to MS so that I can run an MS Update to get the patch’s, but can’t do it because it shuts down.

I then ran (for “giggles” NOT) the “stinger” again which scans for 30 viruses (which is how I got rid of the Blast worm that I had a few weeks back (and yes, I also installed the MS patch for that). When I ran that – (it had previously cleaned everything) – I found the Nachiworm and also the Lovsanworm. It found and deleted both of these.

I can’t get connected to the internet to download anything and the one or two times I was able to go to MS Update, I got an error message back indicating that it was unsuccessful because my computer is set to not allow Active X. If I go to my settings, I have the default ones (which are medium) – I even tried to go to medium/low to see if this would help – it did not. Would the fact that I have the firewall enabled keep me from being able to download ActiveX???

I’m at a loss as to what to do next.
Any suggestions would be MOST appreciated!!!!!
Lydia

For the Windows update problem, try this page:

Windows Update Problems.

The most generally helpful items are on the bottom of the page, so you might start looking there.

Secondly, Anti-Virus software's most useful function is to prevent these infections in the first place. What ever AntiVirus software you're using isn't doing the job. Either it is not working correctly, or is not updated frequently enough.

What AntiVirus program are you running?

Dwight

Shame on me Dwight.....see HERE

Lydia, I'm assuming you're using Windows XP. Log on as an administrator, then click Start, point to Connect To, then right-click your Internet connection and click Properties. Click the Advanced tab and select "Protect my computer...".

Dwight, I did what it said in the bottom of that site in terms of allowing ActiveX's...also followed the instructions that I got on the windowsupdate page...

Tom - I "protected my computer"...

still unable to do anything about running a windows update. got the following error message:
The Windows Update software did not update successfully. Below are some suggestions to help you proceed:
You may have clicked No when prompted to accept the Trust Certificate. To allow the Windows Update site software to install, click Yes when presented with the Security Warning dialog box.
Your Internet Explorer security settings may be set too high. To install the updated software and access Windows Update, Internet Explorer security must be set to medium or lower, and active scripting and the download and initialization of ActiveX controls must be enabled.

Note These are the default settings for Internet Explorer. For more information about Internet Explorer security and instructions on how to change your security settings, read Microsoft Knowledge Base (KB) Article Q174360.

I was able to run the fix's to get rid of both the Blast and the Welchia...what I am not able to do is to connect to MSUpdate (the Welchia worm does sometimes prohibit this connection) and I went directly to the link for the particular patch from MS (rather than MSUpdate) and the error message I get back indicates that I need to make sure that cryptographic services are running - they are...but it still will not work.

If I can't get the patches, obviously I will get the worm again and again. Is there any other way to get a patch?

This page has information about getting direct support from Microsoft with Windows Update problems:

Windows Support

Any kind of popup stopper or "hosts" file can prevent the Windows update page from running. Also, have you tried disabling the AntiVirus and Firewall programs temporarily to see if the update page works?

Be sure to re-enable the antivirus and firewall when complete.

Dwight

Dwight,
I have no popup stopper running. What is a "host" file?

What is the Hosts file?

Everything (and maybe more) that you ever wanted to know about the Windows hosts file.

I use this as a popup stopper and if I don't disable it (using the Host Toggle ) the Windows Update page won't open.

Dwight