F-Welchi

F-Welchi is a small removal utility that will rapidly disinfect systems infected with the Welchi worm.

￭ Unpack the F-Welchi utility from the provided ZIP archive ￭ Run the unpacked F-Welchi.exe file from a hard disk to eliminate the Welchi worm infection. You can run the utility by either double clicking on it from Windows Explorer or you can start it from a command interpreter (COMMAND.COM or CMD.EXE) by typing its name at command prompt and pressing 'Enter' (for advanced users). First the F-Welchi utility will kill Welchi worm's process in memory. Then the utility will remove the registry values and the additional worm copies from the startup folders. ￭ Reboot the system. After restart your system should be clean. If you have F-Secure Anti-Virus installed, the utility will temporarily disable on-access scanner to be able to disinfect your system. After the utility completes disinfection, it enables on-access scanner.

If a computer with Windows NT, 2000 or XP operating system is being disinfected, please log in as Administrator or as a user with local admin rights, otherwise the F-Welchi utility might not disinfect the system correctly.

If you have Windows ME or XP, it is recommended to disable System Restore feature of these operating systems to prevent your computer from re-infection with Welchi worm. The fact is that System Restore feature of these operating systems might save the infected file into the special folder and copy it back to a hard drive it every time it's been deleted by F-Welchi utility.