Tilted Forum Project Discussion Community - View Single Post

cliche · 10-25-2003, 02:29 PM

Are you sure you don't (still?) have the Welchia / Nachi worm? It adds 2 services to your computer, one of which is called "WINS client". Have a look in your WINNT\System32 directory - if there's a directory called "WINS" in there, containing 2 files (dllhost.exe and svchost.exe), you have the worm. Also, have a look at your services for:

Network Connections Sharing (rpctftpd)
WINS Client (rpcpatch)

There's loads of ways to get rid of it; search google or ask here.

Just a thought - when you mentioned crashing, worms, and "WINS client"...

10-25-2003, 02:29 PM	#2 (permalink)
cliche Rookie Location: Oxford, UK	Are you sure you don't (still?) have the Welchia / Nachi worm? It adds 2 services to your computer, one of which is called "WINS client". Have a look in your WINNT\System32 directory - if there's a directory called "WINS" in there, containing 2 files (dllhost.exe and svchost.exe), you have the worm. Also, have a look at your services for: Network Connections Sharing (rpctftpd) WINS Client (rpcpatch) There's loads of ways to get rid of it; search google or ask here. Just a thought - when you mentioned crashing, worms, and "WINS client"... __________________ I can't understand why people are frightened of new ideas. I'm frightened of the old ones. -- John Cage (1912 - 1992)