Amid the several viral and wormy outbreaks that buffeted the Internet this past August, one had a peculiar modus operandi. Whereas the Sobig.F virus jammed up networks with virulent e-mail and the Blaster worm forced its host machines to reboot every few minutes, Welchia seemed to have honorable intentions. Some observers dubbed it a "white hat" worm.

After it enters a new PC, the Welchia worm forces the computer to contact Microsoft's Windows Update Web site and download a patch for the very hole that it and Blaster exploit. Welchia next attempts to remove the Blaster worm if the host machine is afflicted with it. Welchia then scans the local network for more vulnerable systems and attempts to procreate. But it contains an unusual subroutine: come New Year's Day 2004, the Welchia program deletes itself.

This article was originally published with the title Malcode Melee.

Comments