1. /
  2. Security Response/
  3. W32.Welchia.B.Worm


Risk Level 2: Low

February 11, 2004
February 13, 2007 12:17:18 PM
Also Known As:
W32/Nachi.worm.b [McAfee], W32/Nachi-B [Sophos], Win32.Nachi.B [Computer Associ, WORM_NACHI.B [Trend], Worm.Win32.Welchia.b [Kaspersk
Systems Affected:
Windows 2000, Windows XP
CVE References:
CAN-2003-0812 CAN-2003-0352 CAN-2003-0109 CAN-2003-0003

As of April 28, 2004, due to a decreased rate of submissions, Symantec Security Response has downgraded this threat to a Category 2 from a Category 3.

W32.Welchia.B.Worm is a variant of W32.Welchia.Worm. If the version of the operating system of the infected machine is Chinese (Simplified), Chinese (Traditional), Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun and Microsoft Messenger Service Buffer Overrun patches from the Microsoft® Windows Update Web site, install it, and then restart the computer.

The worm also attempts to remove the W32.Mydoom.A@mm and W32.Mydoom.B@mm worms.

W32.Welchia.B.Worm exploits multiple vulnerabilities, including:

The presence of the file, %Windir%\system32\drivers\svchost.exe, is an indication of a possible infection.

This threat is compressed with UPX.

Note: Virus definitions dated February 11, 2004 revision 23 (20040211.023 or Defs Version 60211w) or later will detect this threat.

Translations of this Document:
Given the time needed to translate documents into other languages, the translated versions of this document may vary in content if the English document was updated with new information during the translation process. The English document always contains the most up-to-date information.

Available translations:
Simplified Chinese
Traditional Chinese

Antivirus Protection Dates

  • Initial Rapid Release version February 11, 2004
  • Latest Rapid Release version January 13, 2015 revision 019
  • Initial Daily Certified version February 11, 2004
  • Latest Daily Certified version August 21, 2012 revision 002
  • Initial Weekly Certified release date February 11, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment


  • Wild Level: Medium
  • Number of Infections: More than 1000
  • Number of Sites: More than 10
  • Geographical Distribution: High
  • Threat Containment: Easy
  • Removal: Moderate


  • Damage Level: Low


  • Distribution Level: Medium
Writeup By: Yana Liu

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver