W32.Welchia.K

W32.Welchia.K is a worm that spreads by exploiting Windows vulnerabilities. It is similar to W32.Welchia.D.Worm.

W32.Welchia.K uses the following vulnerabilities:

• The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm specifically targets Windows XP machines using this exploit.
• The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80. The worm specifically targets machines running Microsoft IIS 5.0 using this exploit. The worm's use of this exploit will impact Windows 2000 systems and may impact Windows NT/XP systems.
• The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445.
• The Locator service vulnerability using TCP port 445 (described in Microsoft Security Bulletin MS03-001). The worm specifically targets Windows 2000 machines using this exploit.
• The Mydoom backdoor (port 3127).

If the operating system of an infected computer is Chinese, Korean, or English, the worm will attempt to download and install security patches from the Microsoft Windows Update Web site to patch these vulnerabilities.

The worm also attempts to remove the W32.Mydoom.A@mm, W32.Mydoom.B@mm, W32.HLLW.Doomjuice, and W32.HLLW.Doomjuice.B worms.

The presence of the file %System%\drivers\svchost.exe is an indication of a possible infection.

---

Notes:

• Virus definitions dated prior to May 5, 2004 detect this threat as W32.Welchia.gen.
• The MD5 hash value for this worm is 0xca4a22fbe17174b64cba91351c70fc9c.

---

Protection

• Initial Rapid Release version May 6, 2004
• Latest Rapid Release version May 6, 2004
• Initial Daily Certified version May 6, 2004
• Latest Daily Certified version May 6, 2004
• Initial Weekly Certified release date May 12, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Medium