
	Where results make sense

Topic: Welchia

	Worms Hit Home
		Welchia in particular has already been with us for a long time (relatively speaking) but it's still very much alive.
		I investigate further and the majority of the traffic belongs to Welchia, the worm that was released to fix the infamous Blaster but then became a menace in itself.
		We all know that Welchia first came out months ago and exploited the RPC DCOM vulnerability that Microsoft had patched several months prior, yet on my little subnet of the world here in high-bandwidth Canada, it has never been stronger.
	www.securityfocus.com /columnists/216 (1818 words)

	Welchia (computer worm) - Wikipedia, the free encyclopedia
		The Welchia worm, also known as the "Nachia worm," is a computer worm that exploits a vulnerability in the Microsoft Remote procedure call (RPC) service similar to the Blaster worm.
		Because of these effects, the worm was perceived as a threat, and a patch was released by all major anti-viral companies.
		Fixing a system infected with the Welchia worm is very simple, involving several command-line processes:
	en.wikipedia.org /wiki/Welchia (404 words)

	Welchia - The Anti-Virus Virus?
		Welchia belongs to the family of viruses that attack other malware, fighting for control of the system.
		Welchia breaches computers using the same DCOM RPC vulnerability that Lovesan used.
		Welchia has already spread around the world and should probably decrease Lovesan infections in about a week's time.
	www.kaspersky.com /info?id=986154 (362 words)

	Enterprise Systems \| State Department Blames Welchia Virus For Shutdown
		Recently Welchia was in the news as the cause of an epidemic at the end of August 2003 when it compromised hundreds of thousands of computers the world over.
		Welchia deletes the Lovesan virus, restores the damaged system and downloads the Windows patch needed to close the vulnerability.
		Despite seemingly good intentions, Welchia is a dangerous virus that spread via a powerful distribution system enabling it to span the globe within minutes.
	www.esj.com /Security/print.aspx?editorialsId=732 (621 words)

	Blaster variant offers 'fix' for pox-ridden PCs
		Welchia (AKA MSblast-D, Nachi and LovSan-D) also exploits the WebDav vulnerability (see this MS advisory from March) using TCP port 80.
		Welchia checks for active machines to infect by sending an ICMP echo, or PING, which will result in increased ICMP traffic.
		Welchia provokes the same ethical issues as CodeGreen, the virus-like code that attempted to patch systems infected with the Code Red worm.
	www.securityfocus.com /news/6760 (338 words)

	USATODAY.com - New Internet worm tries to patch Windows hole (Site not responding. Last check: 2007-10-17)
		The new worm, dubbed "Welchia" or "Nachi," is similar to Blaster, but it purports to patch the hole Blaster exploited to enter into computers in the first place and tries to clean up after Blaster if the computer is infected with it.
		Welchia, which is programmed to delete itself in 2004, is spreading widely in Asia, particularly in Japan, according to Hartmann.
		The worm is creating more network traffic, and thus a slowdown, for many corporations as it checks for other vulnerable computers to spread to and because it instructs numerous computers in a network to try to download the patch simultaneously, they said.
	www.usatoday.com /tech/news/computersecurity/2003-08-19-good-worm_x.htm (632 words)

	W32.Welchia.Worm aka W32.Nachi.Worm Characteristics and Removal instructions
		Welchia is a RPC Worm, exploits a vulnerability DCOM RPC [ Buffer Overrun In RPC Interface ] to infect target systems.
		Welchia worm can be avoided by installing security patches from Microsoft.
		Welchia worm infected systems may reboot every few minutes.
	www.srnmicro.com /virusinfo/welchia.htm (300 words)

	How do I protect my computer from the Welchia (W32.Welchia.Worm) worm? - Viruses & Security - HiWAAY Support FAQs
		Welchia is based upon the Blaster worm and takes advantage of known vulnerabilities in Windows RPC and WebDav that allow a remote user to gain access to the targeted computer.
		Welchia sends copies of itself to other vulnerable computers connected to the Internet.
		If you are infected with Welchia, you should go to http://sarc.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html and download Symantec's Welchia Removal Tool.
	www.hiwaay.net /support/faq/index.cgi?view=1&id=291&catid=88 (1210 words)

	'Friendly' Welchia Worm Wreaking Havoc
		What's worse, security experts say, is that the Welchia worm is using two separate vulnerabilities to infect and wreak havoc on networks around the world.
		Welchia looks for the existence of the Msblast.exe file dropped by the W32.Blaster.Worm and deletes it from an affected system, is capable of crippling a large corporate network even if the DCOM/RPC patch is deployed.
		Symantec on Tuesday upgraded the W32.Welchia.Worm from a Level 2 to a Level 4 threat and reported "severe disruptions" on the internal networks of large enterprises caused by ICMP flooding.
	www.internetnews.com /ent-news/article.php/3065761 (996 words)

	Viruslist.com - Net-Worm.Win32.Welchia.a
		As a result, Welchia obtains control over the machine and execute itself every time the computer is re-booted.
		Welchia scans the system for the MSBLAST.EXE process, ends the process and deletes the MSBLAST.EXE file from the hard drive.
		In the first instance, the worm uses values A and B from the current address and scans the Internet for addresses beginning with A.B.0.0, working through all addresses where C and D are greater than zero.
	www.viruslist.com /eng/viruslist.html?id=65727 (441 words)

	Secuser.com - Virus Welchia (W32.Welchia.Worm)
		Welchia est un second virus ciblant les ordinateurs vulnérables à la faille RPC de Microsoft.
		Welchia est un virus qui se propage via le réseau.
		Une fois l'ordinateur infecté, Welchia scanne le réseau à la recherche de nouvelles machines vulnérables, d'où un fort trafic ICMP et un encombrement des réseaux locaux.
	www.secuser.com /alertes/2003/nachi.htm (501 words)

	"Welchia": антивирусный вирус
		"Welchia" принадлежит к разряду вирусов, несущих определенную гуманитарную функцию.
		"Welchia" проводит заражение подобно червю "Lovesan": через бреши в системе безопасности.
		Защита от "Welchia" уже добавлена в базу данных Антивируса Касперского®.
	www.kaspersky.ru /news.html?id=1321286 (268 words)

	Welchia Hits State Department Computers
		A State Department spokesperson told internetnews.com the Welchia worm was detected in its Consular Lookout and Support System (CLASS), which ties into databases from law enforcement agencies to screen visa applications at embassies worldwide.
		"Welchia disrupts the speed of the network and slows normal communications to a crawl," she said, noting that the CLASS system was not damaged by the infection.
		The State Department spokesperson said the infection was the result of "something introduced into the network" and dismissed suggestions that the Welchia worm may have sneaked into an unpatched system.
	www.internetnews.com /dev-news/article.php/3082611 (553 words)

	W32.Welchia.Worm ; The friendly worm
		Welchia exploits the same vulnerability in Windows as the Blaster worm which caused a lot of trouble last week.
		Special is that the Welchia worm attempts to download the DCOM RPC patch from the Windows update site, and also tries to remove the Blaster virus from your PC.
		Welchia appears to be programmed to remove itself from an infected computer in 2004.
	www.dvhardware.net /article.php?sid=1768 (646 words)

	Of Dying Viruses and Dangerous Xmas Cards
		When Welchia firsts runs, it checks to see if it has infected before by checking a special flag or Mutex, which it creates on the system.
		In August, when Welchia first was discovered, as with Blaster, many systems were infected because their owners had not applied the security updates, which had been available for several months prior.
		Welchia and Blaster are still high on the threats list because there are still many unpatched machines.
	www.pcmag.com /article2/0,4149,1419314,00.asp (1460 words)

	Fix for the W32.Blaster.Worm and Welchia : OIT Security Center Support for McAfee VirusScan
		Fix for the W32.Blaster.Worm and Welchia : OIT Security Center Support for McAfee VirusScan
		Note: Even if your computer is acting normally, it may still be infected.
		Download and install a tool to remove the Welchia ariant.
	www.auburn.edu /oit/security_center/virus/ht_virus_removal.php (612 words)

	PC World - Welchia Worm Nails Navy Marine Corps
		First seen Monday, the Welchia worm attempts to eradicate the Blaster worm, which spread to millions of Windows-based PCs last week.
		The Welchia worm exploits the same Remote Procedure Call vulnerability as Blaster, as well as invoking what's called the WebDAV vulnerability in unpatched Windows-based machines.
		The Welchia worm has infected an unspecified number of computers within the Navy Marine Corps Intranet, which has about 100,000 users.
	www.pcworld.com /article/112090-1/article.html (476 words)

	PC Hell: Welchia Worm and MSBLAST.D Virus Removal Instructions
		The Welchia (MSBLAST.D or Nachi) worm infects machines via network connections.
		Follow these steps in removing the Welchia or MSBLAST.D worm.
		With its intelligent alert warning system and full quarantine, backup and restore features, SpyEraser is the best defense for protection against attack from malware pests.
	www.pchell.com /virus/welchia.shtml (966 words)

	Green Apple: Support: Security: PC Sentry: MSBlaster
		Welchia is a variant of the worm MSBlast.
		Green Apple has disabled ingress/egress on ports used by Welchia which greatly lessen the capability for the worm to enter or leave our network and affect our users.
		However, every Windows user is urged to visit Microsoft's Windows Update and install the patch to close the RPC Buffer Overrun flaw.
	www.greenapple.com /support/security/pc-sentry/welchia.htm (203 words)

	100% CPU, The Welchia Worm, & Hardware Damage - Dev Shed
		Microsoft Windows is one of the most popular operating systems due to its ease of use.
		For the last couple of days, I've noticed that my CPU was running at 100% and the supposed culprit was a known Microsoft system tool called dllhost.exe.
		I went to sarc.com and learned about the Welchia virus, downloaded their tool and, lo-and-behold, found I was infected!
	forums.devshed.com /windows-help-34/100-cpu-the-welchia-worm-hardware-damage-84059.html (794 words)

	Win32.Welchia (Site not responding. Last check: 2007-10-17)
		This application is a worm, a program that copies itself from computer to computer and, unlike a virus, can replace entire files.
		A truly rare program, Welchia is actually a helpful worm.
		The Welchia worm will, however, restart the user’s computer once in order to complete installation of the Windows patch.
	paretologic.com /resources/definitions.aspx?remove=Win32.Welchia (111 words)

	Navy Marine Corps Intranet hit by Welchia worm - Network World
		First seen Monday, the Welchia worm attempts to eradicate the Blaster worm, which spread to millions of Windows-based machines last week.
		The Welchia worm, which exploits the same Remote Procedure Call (RPC) vulnerability as Blaster - as well as what's called the WebDAV vulnerability in unpatched Windows-based machines - spreads by scanning for new machines to infiltrate, just as Blaster does.
		Navy personnel can still use their desktop PCs to do work, but the LAN-based NMCI is not fully functional due to this scanning congestion caused by Welchia, noted Navy spokeswoman Nicolle Rose.
	www.networkworld.com /news/2003/0819navy.html (717 words)

	Annoyances.org - re: RPC shutdown - BUT can't find Welchia or Blast on the system! (Windows XP Discussion Forum)
		>was MSBlast or Welchia and tried the Symantec removal Fixes and also AVG scans and
		RPC shutdown - BUT can't find Welchia or Blast on the system!
		Please do not plagiarize; redistributing these pages without permission is strictly prohibited.
	www.annoyances.org /exec/forum/winxp/1075872374 (540 words)

	PC World - Welchia Worm Nails Navy Marine Corps
		Military intranet is being cleansed of digital pests.
		Welchia spreads by scanning for new machines to infiltrate, just as Blaster does.
		Navy personnel can still use their desktop PCs to do work, but the LAN-based NMCI is not fully functional due to this scanning congestion caused by Welchia, says Nicolle Rose, a Navy spokesperson.
	www.pcworld.com /news/article/0,aid,112090,tk,dn082003X,00.asp (481 words)

	I have a w32.welchia.b.worm in my computer, does anyone know... - Q&A
		Yes, I turned off the system restore, passed the tool, I made everything I could do...and my Symantec Auto-Protect continues reporting me the presence of the virus, I see the files WksPatch but I can´t do anything.
		I went into safe mode and ran the system scan and the welchia removal tool.
		I am fedup with this welchia worm as I cannot seem to rid of it.
	www.faqs.org /qa/qa-13911.html (4490 words)

	Information Security Office (Site not responding. Last check: 2007-10-17)
		If you support other computer users you may want to consider copying these to floppies or a CD-ROM.
		Symantec has developed a Removal Tool for Welchia.
		The tool can be downloaded directly, but it is recommended that you review the accompanying instruction page first.
	www.yale.edu /its/security/welchia/index.html (276 words)

	CNN.com - 'Welchia worm' hits U.S. State Dept. network - Sep. 24, 2003
		CNN.com - 'Welchia worm' hits U.S. State Dept. network - Sep. 24, 2003
		A computer worm named "Welchia" contaminated part of the U.S. State Department's computer network on Tuesday, according to a senior State Department official.
		The worm did not affect the network's classified files.
	www.cnn.com /2003/TECH/internet/09/24/state.dept.virus/index.html (276 words)

	Viruslist.com - Net-Worm.Win32.Welchia.b
		The worm is written in Visual C++, and is approximately 12KB (12800 bytes) in size, compressed using UPX.
		This version of Welchia attempts to find and delete the worms Mydoom.a and Mydoom.b from the computer.
		The worm then sends a packet which loads Welchia from the host machine.
	www.viruslist.com /eng/viruslist.html?id=949424 (462 words)

	Navy swabs decks clean of Welchia
		By late last week, the Navy—the federal agency hardest hit by Welchia, the worm that mimicked MSBlaster—had nearly finished cleaning up from the virus fallout.
		Those few systems still infected have been identified mainly as portable PCs belonging to active-duty sailors and Navy reservists who were on vacation or leave over the past few weeks, a Navy spokeswoman said.
		In cases where a user was on vacation while the worm choked Internet and e-mail access to more than 50,000 systems, “they’ll have to plug into the NMCI network and download the patch,”; the spokeswoman said.
	www.gcn.com /print/22_25/23364-1.html (202 words)

	Blaster and Welchia Worms On Campus
		This worm and its variants (Welchia), exploited a vulnerability in Windows 2000 and XP systems.
		Support staff will assist you in developing a plan to protect your machine from future attacks.
		See the Symantec Blaster and Welchia Web pages for a description of tools to detect and remove these worms (FixBlast.exe and FixWelch.exe).
	ist.uwaterloo.ca /isthome/oldhtdocs/blasterwelchia.htm (155 words)

	Remove Worm & Virus - Welchia (Nachi,MSBLAST.D, Lovsan)
		The W32.Welchia (also known as Nachi, MSBLAST.D, Lovsan) is a worm that exploits multiple vulnerabilities, including:
		The easiest way to remove this worm is to download a removal tool developed by Symantec.
		You can also follow below instructions to manually remove Welchia from your computer.
	www.spyany.com /program/article_wm_rm_Welchia.html (492 words)

	Remove Welchia Worm, Delete RpcTftpd, RpcPatch, MSBlast.D, LoveSan.D, Nachia, wins\svchost.exe, wins\dllhost.exe
		Remove Welchia Worm, Delete RpcTftpd, RpcPatch, MSBlast.D, LoveSan.D, Nachia, wins\svchost.exe, wins\dllhost.exe
		The Welchia worm infects machines via network connections.
		If Panda Antivirus detects Welchia during the scan, it will AUTOMATICALLY offer you the option of deleting it.
	www.securemost.com /articles/trou_5_welchia.htm (958 words)

Try your search on: Qwika (all wikis)