W32.Welchia.C.Worm is a minor variation of, and functionally equivalent to W32.Welchia.B.Worm
If the version of the operating system of the infected machine is Chinese, Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun
and Microsoft Messenger Service Buffer Overrun
patches from the Microsoft® Windows Update Web site, install it, and then restart the computer.
The worm also attempts to remove W32.Mydoom.A@mm
W32.Welchia.C.Worm exploits multiple vulnerabilities, including:
The presence of the file, %Windir%\system32\drivers\svchost.exe, is an indication of a possible infection.
This threat is compressed with UPX.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.