WARNING : W32.Welchia.B.Worm
Threat level : Category 3, Moderate (scale of 1-5)
Type : Worm
What is W32.Welchia.B.Worm and how does it affect me?
As of February 13, 2003, due to an increased rate of submissions, Symantec Security Response has
upgraded this threat to a Category 3 from a Category 2.
W32.Welchia.B.Worm is a variant of W32.Welchia.Worm. If the version of the operating system of the infected machine is Chinese, Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun and Microsoft Messenger Service Buffer Overrun patches from the Microsoft® Windows Update Web site, install it, and then restart the computer.
W32.Welchia.B.Worm propagates by exploiting the:
1. Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205)
2. Microsoft Windows ntdll.dll Buffer Overflow Vulnerability (BID 7116)
3. Microsoft Windows Workstation Service Remote Buffer Overflow Vulnerability (BID 9011)
The worm also attempts to remove the W32.Mydoom.A@mm and W32.Mydoom.B@mm
worms
if any of this is too technical, please let me know and i will attempt to explain
best thing to do people, update your virus definitions !