W32.Welchia.B.Worm

As of April 28, 2004, due to a decreased rate of submissions, Symantec Security Response has downgraded this threat to a Category 2 from a Category 3.

W32.Welchia.B.Worm is a variant of W32.Welchia.Worm. If the version of the operating system of the infected machine is Chinese (Simplified), Chinese (Traditional), Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun and Microsoft Messenger Service Buffer Overrun patches from the Microsoft® Windows Update Web site, install it, and then restart the computer.

The worm also attempts to remove the W32.Mydoom.A@mm and W32.Mydoom.B@mm worms.

W32.Welchia.B.Worm exploits multiple vulnerabilities, including:

• The DCOM RPC vulnerability (first described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm specifically targets Windows XP machines using this exploit. We recommend that you patch this vulnerability by applying Microsoft Security Bulletin MS03-039.
• The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80. The worm specifically targets machines running Microsoft IIS 5.0 using this exploit. The worm's use of this exploit will impact Windows 2000 systems and may impact Windows NT/XP systems.
• The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users are protected against this vulnerability if Microsoft Security Bulletin MS03-043 has been applied. Windows 2000 users must apply MS03-049.
• The Locator service vulnerability using TCP port 445 (described in Microsoft Security Bulletin MS03-001). The worm specifically targets Windows 2000 machines using this exploit.

The presence of the file, %Windir%\system32\drivers\svchost.exe, is an indication of a possible infection.

This threat is compressed with UPX.

---

Note: Virus definitions dated February 11, 2004 revision 23 (20040211.023 or Defs Version 60211w) or later will detect this threat.

---

Translations of this Document:
Given the time needed to translate documents into other languages, the translated versions of this document may vary in content if the English document was updated with new information during the translation process. The English document always contains the most up-to-date information.

Available translations:
German
French
Italian
Portuguese
Spanish
Korean
Japanese
Simplified Chinese
Traditional Chinese

Protection

• Initial Rapid Release version February 11, 2004
• Latest Rapid Release version June 30, 2008 revision 049
• Initial Daily Certified version February 11, 2004
• Latest Daily Certified version July 1, 2008 revision 003
• Initial Weekly Certified release date February 11, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: High
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: Medium