Welchia/Nachi Weirdness

JimIT · Oct 23, 2003

Well, just for grins, I put an unpatched, but AV-protected machine on the wire to see what would happen w/Blaster-Welchia, using a fresh install of w2k w/AntiVir PE to mess around. AntiVir also does a full system scan after install, which turned up nothing.

About 20 minutes later, I hear a "beep!", and sure enough, there sits Welchia in quarantine, and AntiVir shows 1 nasty intercepted.

HOWEVER, upon checking the quarantined file, I also discovered a .com file beside it which AntiVir has ID'd as Atom!

Assuming this is a false-positive, I quickly tested with NAV, and Housecall, and darned if they both didn't flag Atom also.

My question is: Is it possible that something piggy-backed with Welchia?

LowWaterMark · Oct 24, 2003

Well, why think that it had to piggy-back on anything? From what you said it was an unpatched W2K machine with only an AV running. (You didn't say what services it was running - all defaults perhaps?) Welchia isn't the only nasty out there. I think you can expect any number of malware infections on such a machine.

JimIT · Oct 31, 2003

quoting: LowWaterMark link=board=31;threadid=15327;start=0#msg95915 date=1067042716]
Well, why think that it had to piggy-back on anything? From what you said it was an unpatched W2K machine with only an AV running. (You didn't say what services it was running - all defaults perhaps?) Welchia isn't the only nasty out there. I think you can expect any number of malware infections on such a machine.
Click to expand...

I suppose. It's just unusual to see that virus bouncing around, as I've never encountered it otherwise. Seems odd that it would just waltz in like that.

Ah well. Learn something new every day.

Log in or Sign up

Welchia/Nachi Weirdness

JimIT Registered Member

LowWaterMark Administrator

JimIT Registered Member

Log in or Sign up

Welchia/Nachi Weirdness

JimIT Registered Member

LowWaterMark Administrator

JimIT Registered Member

Useful Searches