What is W32.Welchia.B.Worm and how does it affect me?

As of February 13, 2003, due to an increased rate of submissions, Symantec Security Response has
upgraded this threat to a Category 3 from a Category 2.

W32.Welchia.B.Worm is a variant of W32.Welchia.Worm. If the version of the operating system of the infected machine is Chinese, Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun and Microsoft Messenger Service Buffer Overrun patches from the Microsoft® Windows Update Web site, install it, and then restart the computer.

W32.Welchia.B.Worm propagates by exploiting the:
1. Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205)
2. Microsoft Windows ntdll.dll Buffer Overflow Vulnerability (BID 7116)
3. Microsoft Windows Workstation Service Remote Buffer Overflow Vulnerability (BID 9011)

The worm also attempts to remove the W32.Mydoom.A@mm and W32.Mydoom.B@mm
worms.

Please Note: Virus definitions dated February 11, 2004 revision 23
(20040211.023 or Defs Version 60211w) or later will detect this threat.

source: Symantec Corp

__________________
Hybrid

linkShareLive <-- Free and Paid Directory Listing (get your website listed now)
'Forever busy.... is there more to life?'
Microsoft TechNet Member
My Space Profile: http://www.myspace.com/syrusxl