Log in

No account? Create an account
11 March 2004 @ 03:28 pm
So it turns out that I have several worms on my system. I think I acquired a couple of them while in the process of trying to get rid of the others. Or something. At this point I don't entirely care, just so long as it Never Happens Again.

But in researching one of the other worms I have, I came across this description of its effects:

W32.Welchia.Worm does the following:

- Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then restart the computer
- Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic
- Attempts to remove W32.Blaster.Worm

If I'm reading this right, I have a worm that attempts to download and install a security patch that will fix the hole it just exploited, and tries to remove another nasty worm.

I'm trying to figure out if this is an anti-worm worm, or if this is just some bizzare form of a worm pissing contest. ("I'm the top worm on this system!" "Oh yeah? Well I'm going to go delete you so that I'M the top worm!")
Max Kaehn: Cuteslothman on March 12th, 2004 12:34 am (UTC)
I figure that worms that patch their own security holes are written by frustrated people who are tired of waiting for other people to patch their own systems. I’m very glad that I run Linux, which is not as prone to infection as Windows...
(Anonymous) on March 12th, 2004 03:16 am (UTC)
White worms
Yep, some 'hackers' have written viruses to try to patch the systems before the more malicious variety gets in...

Sounds great, until you hear how various large business networks were taken down by this 'friendly' virus due to the amount of traffic it generates.

There are still debates going as to the legality of 'white' worms and viruses...