W32.Welchia.B.Worm这个是新病毒吗？？

ilsem

以前从没中过这个毒，rpc补丁也都打好了

元宝姐姐

传到诺顿的病毒中心问问~

Guevara

symantec首页就是它  恭喜~~~~~~~~
http://www.symantec.com/region/cn/
As of February 13, 2004, due to an increased rate of submissions, Symantec Security Response has upgraded this threat to a Category 3 from a Category 2.

W32.Welchia.B.Worm is a variant of W32.Welchia.Worm. If the version of the operating system of the infected machine is Chinese, Korean, or English, the worm will attempt to download the Microsoft Workstation Service Buffer Overrun and Microsoft Messenger Service Buffer Overrun patches from the Microsoft® Windows Update Web site, install it, and then restart the computer.

The worm also attempts to remove the W32.Mydoom.A@mm and W32.Mydoom.B@mm worms.

W32.Welchia.B.Worm exploits multiple vulnerabilities, including:


The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm specifically targets Windows XP machines using this exploit.
The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80. The worm specifically targets machines running Microsoft IIS 5.0 using this exploit. The worm's use of this exploit will impact Windows 2000 systems and may impact Windows NT/XP systems.
The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445.
The Locator service vulnerability using TCP port 445 (described in Microsoft Security Bulletin MS03-001). The worm specifically targets Windows 2000 machines using this exploit.

The presence of the file, %Windir%\system32\drivers\svchost.exe, is an indication of a possible infection.

This threat is compressed with UPX.


去update一下 打上补丁

元宝姐姐

明天赶紧买彩票~

莫尼卡

仔细看英文！对中文/韩文/英文的系统无害！在这三个系统下将会自动连接到 ms 官方站点下载 Rpc 补丁并重启系统。自动尝试清除W32.Mydoom.A@mm 和 W32.Mydoom.B@mm。如果是日文系统那么……^_^ 恭喜你将受到灭顶之灾。

Guevara

哈哈~~~~~~~是嘛 我还没看 看来是个爱国病毒了 日！！！

元宝姐姐

晕啊~~  还自动清除什么木马病毒一刚~SO搞笑 哈哈~~~~

Guevara

大家去中啊······

ilsem

原文由 莫尼卡 在 2004-02-18 18:47:17  发表
仔细看英文！对中文/韩文/英文的系统无害！在这三个系统下将会自动连接到 ms 官方站点下载 Rpc 补丁并重启系...

我昨天中的时候就去诺顿的相关页看了，可都是英文，懒得去看，大致就看懂了下载update什么的，我就照着下载了那个中文xp的补丁 打上了，诺顿2004到现在还没有报警过，看来这是针对日本人出的病毒了，又是亚洲哪个愤青炮制的吧，我喜欢，支持，顶一下，为我中这个病毒感到高兴

hzhou

这个变种很厉害的，早就碰到过几个病毒了，到symantec去下个专杀补丁才行。