|
|
Welchia.(Security News)(Brief Article)
- Article from:
-
Software World
- Article date:
-
September 1, 2003
|
Copyright informationCOPYRIGHT 2003 A.P. Publications Ltd. This material is published under license from the publisher through the Gale Group, Farmington Hills, Michigan. All inquiries regarding rights should be directed to the Gale Group. (Hide copyright information)
|
Welchia seeks out computers infected by Lovesan (Blaster), disinfects them and installs the Windows patch. Welchia belongs to the family of helpful viruses that actually benefit users. Members of this family penetrate computers, but do not cause any damage.
Such worms delete other malware and implement protective measures. The most famous worm from this family appeared in September 2001: CodeBlue searched the Internet for machines infected by CodeRed and disinfecteded them.
Welchia breaches computers using the same DCOM RPC vulnerability that Lovesan used. However, Welchia also uses the WebDAV (http://www.microsoft.com/technet/security/bulletin/MS03-007.asp) ...