|
Use these links for brief descriptions of the three major worms, links to more detailed descriptions, and instructions on patches to fix these issues. Although we are making every effort to combat the effect of these worms, we need to ask for your help. We need you to patch your machines to reduce and hopefully eliminate the effects of these worms.
W32.Welchia.Worm
W32.Welchia.Worm attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer.
It searches for active machines to infect which results in increased traffic (overloads). A security issue has been identified in Microsoft® Windows® that could allow an attacker to take control of your computer. This issue is most likely to affect computers used as Web Servers. You can help protect your computer from this vulnerability by installing this update from Microsoft.
Affects Microsoft Windows NT® 4.0, Microsoft Windows 2000®, and Microsoft Windows XP®
- W32.Welchia.Worm Removal Tool: Symantec Security Response has developed a removal tool to clean the W32.Welchia.Worm.
- If you are printing this page for reference: this is the "url" of the link in the above bullet: http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
We strongly urge you to download and use the Removal Tool. It's a good idea to be prepared to print out the instructions from the Symantec site and read them thoroughly before you begin the process.
W32.Welchia.Worm Removal Tool does the following:
- Terminates the W32.Welchia.Worm viral processes.
- Deletes the W32.Welchia.Worm files.
- Deletes the registry values that W32.Welchia.Worm added. (Deletion will be performed only if the Operating System has not already removed these values upon terminating the viral processes, as mentioned in bullet 1 above.)
- Deletes the services that W32.Welchia.Worm created.
| 
