But in researching one of the other worms I have, I came across this description of its effects:
W32.Welchia.Worm does the following:
- Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then restart the computer
- Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic
- Attempts to remove W32.Blaster.Worm
If I'm reading this right, I have a worm that attempts to download and install a security patch that will fix the hole it just exploited, and tries to remove another nasty worm.
I'm trying to figure out if this is an anti-worm worm, or if this is just some bizzare form of a worm pissing contest. ("I'm the top worm on this system!" "Oh yeah? Well I'm going to go delete you so that I'M the top worm!")