1. Symantec/
  2. Security Response/
  3. W32.Welchia.D.Worm


Risk Level 2: Low

February 23, 2004
February 13, 2007 12:17:56 PM
Systems Affected:

W32.Welchia.D.Worm is a minor variant of W32.Welchia.C.Worm.

If the operating system of an infected computer is Chinese, Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun and Microsoft Messenger Service Buffer Overrun patches from the Microsoft Windows Update Web site, install it, and then restart the computer.

The worm also attempts to remove the W32.Mydoom.A@mm, W32.Mydoom.B@mm, W32.HLLW.Doomjuice, and W32.HLLW.Doomjuice.B worms.

W32.Welchia.D.Worm exploits multiple vulnerabilities, including:
  • The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm specifically targets Windows XP machines using this exploit.
  • The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80. The worm specifically targets machines running the Microsoft IIS 5.0 using this exploit. The worm's use of this exploit will impact Windows 2000 systems, and may impact Windows NT/XP systems.
  • The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445.
  • The Locator service vulnerability using TCP port 445 (described in Microsoft Security Bulletin MS03-001). The worm specifically targets Windows 2000 machines using this exploit.

In addition, W32.Welchia.D.Worm attempts to exploit the W32.Mydoom.A@mm backdoor (port 3127) to spread.

The presence of the file, %Windir%\System32\Drivers\Svchost.exe, is an indication of a possible infection.

This threat is compressed with UPX.

Antivirus Protection Dates

  • Initial Rapid Release version February 23, 2004
  • Latest Rapid Release version September 6, 2017 revision 035
  • Initial Daily Certified version February 23, 2004
  • Latest Daily Certified version September 7, 2017 revision 001
  • Initial Weekly Certified release date February 23, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Frederic Perriot

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube