Nachi virus

[Skii]

Ok

I'm getting a little annoyed with this AVG window popping up and warning me that I have this damn virus / worm

I've run 2 different patches to remove it , which were apparently successful, but STILL this bloody warning keeps popping up

Any ideas !?!!?!?!

[Skii]

oh god now m8 system just shut itself down

[directhex]

run windows update so you stop re-infecting yourself?

[Anders]

Yep, you need to download the windows update to plug the RPC problem. If for some reason you can’t download it, then according to Microsoft the ports that need to be blocked are incoming TCP ports 80, 135, 139, 445 and 593; UDP ports 135, 137, and 138.

I would have thought a firewall would all ready block the ports used by this worm. If you’ve not got a firewall then you should. I use Zone Alarm Pro myself, but I’m sure others may recommend another. You can get the free version from here

If AVG continues not to work, there is a tool to remove the worm on this site. If you are using XP you’ll need to disable system restore in order to successfully remove the worm. I think you’ll need to install the Microsoft patches/block the ports before you use the tool otherwise you’ll just get re-infected when you go online.

[Skii]

Thanks guys - I don't have a Firewall so now might be a good time to install Zonealarm, but I did download Service pack 1 and critical updates from Microsoft before any of this happened

[Richie]

Unfortunaetly this virus attacks in a different way from the norm. Most viruses are brought into a pC by the user thru email, floppy etc but the Nachi one actually scans the internet for vunerable machines and infects automatically so you may be removing it and being re-infected over and over....


So run a firewall, update windows then run the removal programs and you should never get it again.

[s1lv3r]

worth making a note that both blaster and nachi can remain resident in the system restore files even after you've swept for virii and done all the updates... you just have to disable and reenable it.. (you lose your restore points unfortunatly)

[daniel_owen_uk]

Originally posted by s1lv3r
worth making a note that both blaster and nachi can remain resident in the system restore files even after you've swept for virii and done all the updates... you just have to disable and reenable it.. (you lose your restore points unfortunatly)

Although its infected with the virus anyway so would you really want to keep it?

When you re-enable system restore I think there is an option to set one, might be worth doing if you ever use system restore.