Summary
Worm:W32/Welchi is an unusual malware in that it attempts to disinfect the computer system from Worm:W32/Lovsan infections. It also attempts to patch a vulnerability used by the Lovsan worm to propagate.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Caution: Manual disinfection is a risky process; it is recommended only for advanced users.
The worm will stop working when the computer's clock is set to 2004. This feature can be used to remove the worm from the computer. This can be automated with the date and the shutdown commands, for example:
DATE 01-01-2004
SHUTDOWN -r
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First, check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
The virus code contains the following text string, which is never displayed:
=========== I love my wife & baby :) ~~~ Welcome Chian ~~~ Notice: 2004 will remove myself:) ~~ sorry zhongli~~~=========== wins
Welchi was first reported on August 18th 2003. The worm will stop working when the computer's clock is set to 2004.
Infection
Welchi only infects Windows XP machines through the RPC hole used by the Lovsan worm.
In addition, Welchi will attempt to infect IIS 5.0 web servers via WebDAV exploit. For more on this vulnerability found in March 2003, see http://www.microsoft.com/technet/security/bulletin/MS03-007.asp.
This variant uses files named DLLHOST.EXE and SVCHOST.EXE. Note that these are names of normal Windows system files.
On infection, the worm drops files at the following locations:
- %systemDir%\wins\DLLHOST.EXE - The worm's executable file
- %systemDir%\wins\SVCHOST.EXE - The renamed tftp server
Activity
Unlike most worms, Welchi's effects on the infected system appear to be beneficial. When active, it attempts to disinfect Lovsan.A from the machine by looking for a process with the strings "msblast" in its name (a Lovsan characteristic) and terminating the process if found.
It will then delete the file %systemdir%\msblast.exe, Lovsan's executable copy.
Welchi also attempts to download the Microsoft patch for closing the RPC vulnerability, and tries to download the patch from eight different URLs, corresponding to four language versions (English, Chinese, Simplified Chinese and Korean) for both Windows XP and 2000. This patch routine is not always successful and on clearing Welchi from the machine it is recommended that the patch be checked according to instructions from Microsoft (see the section File Information at http://support.microsoft.com/?kbid=823980).
Registry
When run, Welchi will create a mutex named "RpcPatch_Mutex", to ensure that only one active copy of the worm is ever run.
The worm does not modify the Windows Registry to launch itself automatically.
Protect your devices from malware with F‑Secure Total
Protecting your devices from malicious software is essential for maintaining online security. F‑Secure Total makes this easy, helping you to secure your devices in a brilliantly simple way.
Award‑winning antivirus and malware protection
Online browsing, banking, and shopping protection
24/7 online identity and data breach monitoring
Unlimited VPN service to safeguard your privacy
Password manager with private data protection
Choose how many devices you want to protect to get started.
Free customer support
Cancel anytime
The trial does not obligate you to buy the product
After 30 days your subscription will renew automatically for one year at €69.99.
)
)
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.