1. Symantec/
  2. Security Response/
  3. W32.Welchia.C.Worm


Risk Level 2: Low

February 15, 2004
February 13, 2007 12:17:27 PM
Also Known As:
WORM_NACHI.C [Trend], W32/Nachi.worm.c [McAfee], W32/Nachi-C [Sophos], Win32.Nachi.C [Computer Associ, Worm.Win32.Welchia.c [Kaspersk
Systems Affected:
CVE References:
CAN-2003-0812 CAN-2003-0352 CAN-2003-0109 CAN-2003-0003

W32.Welchia.C.Worm is a minor variation of, and functionally equivalent to W32.Welchia.B.Worm.

If the version of the operating system of the infected machine is Chinese, Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun and Microsoft Messenger Service Buffer Overrun patches from the Microsoft® Windows Update Web site, install it, and then restart the computer.

The worm also attempts to remove W32.Mydoom.A@mm and W32.Mydoom.B@mm worms.

W32.Welchia.C.Worm exploits multiple vulnerabilities, including:

The presence of the file, %Windir%\system32\drivers\svchost.exe, is an indication of a possible infection.

This threat is compressed with UPX.

Antivirus Protection Dates

  • Initial Rapid Release version February 17, 2004
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version February 17, 2004
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date February 18, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: John McDonald

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube