Tech: W32.Welchia.Worm Virus - New !

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Bill D
Date: 23 Aug 03 - 12:29 PM

refreshing this to keep the ideas alive while the issue remains serious out there. Perhaps some who do not have the protections that are being recommended will be inspired to try them.

Here are screen captures from my computer this morning:

One is of my firewall working as an uninvited probe is made


the other is just an image of my antivirus program downloading the latest upgrade (it had done an automatic 'scheduled' update several days ago, but I just clicked on the 'manual' button to keep things current.)

The situation is getting worse, folks...the news is full of this latest batch of worms/viruses, and the creators of these nasty things are getting cleverer...Please...do your part, if you haven't already, to protect both yourself and your friends.

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Bill D
Date: 22 Aug 03 - 03:36 PM

I just started a separate thread on a way to intercept Sobig virus...take a look

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Bev and Jerry
Date: 22 Aug 03 - 02:26 PM

We must not be very important. We've only received 113 "Sobig" e-mails this week.

Bev and Jerry

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: McGrath of Harlow
Date: 22 Aug 03 - 05:12 AM

129 spam emails in my inbox overnight, most of them with attachments and no message, just come-on headings. This is ridiculous. I lost Mailwasher the other day - just reinstalling with the updated version - I hope that improves matters a bit.

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Bill D
Date: 21 Aug 03 - 11:57 PM

there is also a neat program called "SpyBot Search & Destroy" which is AdAware on steroids.

(we have used Netscape 4.79 for quite awhile, but I have gradually switched over to Mozilla and/or its smaller cousin Firebird, which have more advanced features without the AOL stuff embedded.)

I currently use AVG anti-virus (free version) but in trying to get it for my son tonight, it hung my browser 3 times just going to the site..I wonder if it is just that everyone in the universe is trying to get anti-vir stuff today!

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Stilly River Sage
Date: 21 Aug 03 - 11:01 PM

I set up my system so it tells me when there's another windows update, and there's one there today. So all of you, skeedaddle over to Microsoft and download the latest patch from Windows Update. There are two of them (I use Win2000K Pro) and both have to do with security.

SRS

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Mark Cohen
Date: 21 Aug 03 - 10:25 PM

I agree, Bill. I use Netscape (an older version, 4.79) unless I have to use IE because the site doesn't load right otherwise. And I never use Outlook. I use Norton Antivirus...been using Norton Utilities since I got my first computer, an Epson Equity I (IBM-PC clone) in 1985. (The most important thing about an antivirus program, after having it, is to keep it up to date.) ZoneAlarm for a firewall, AdAware to search and destroy spyware, and I just discovered WebWasher, which is a wonderful way to avoid those annoying popups. But I do frequently go out without an umbrella!

Aloha,
Mark

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Bill D
Date: 21 Aug 03 - 08:00 PM

personally, I am trying to hold onto Win98 for as long as possible, as the 'features' Micro$oft put into more recent versions allow a lot of this to happen.

And..[pardon the preaching]...(as I have posted about many times before) one way to avoid email viruses AND spam is to check and delete unwanted email BEFORE it is downloaded ...using an email scanner like EPrompter or PopTray or ScanMailBox. Add to this a good anti-virus program for those little things that sneak in on mail from friends, and you have a decent chance of staying clean. Of course, a firewall is a MUST. I just switched from Outpost to Kerio..mostly because of the 'feel'.

With all of these things in place, I have seen ONE (1) virus in 7 years on the WWW!...and NO lost files, no virus related crashes, no crazy messages about Bill Gates, no disabled programs.

Doing without these protections in this day and age is like playing Russian Roulette...especially if you use Outlook Express, Windows XP and Internet Explorer! You CAN do everything you are now doing without those MicroSoft products which are known targets and needing regular patches!

(I will now go and knock on wood, which I keep in great abundance.)

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Snuffy
Date: 21 Aug 03 - 05:35 PM

It's probably the SoBig one you've been getting in your e-mails

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Jeri
Date: 21 Aug 03 - 05:32 PM

These viruses don't come in e-mails. They spread to computers straight from the internet. If someone's running Win2K or WinXP, has no firewall and hasn't done the security patch thingie, they're at risk even if the just get on the internet.

The attachment worms can propogate pretty fast through address books. I've been on the receiving end of one of these epidemics.

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: McGrath of Harlow
Date: 21 Aug 03 - 04:58 PM

That's what I thought - but I'm still getting my email inbox jammed full of spam with attachments likely related to this.

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Jeri
Date: 21 Aug 03 - 04:46 PM

Ha! An anti-virus virus! Reading the site Jeanie linked to, it seems like this worm kills the Lovsan virus then applies the Microsoft security patch and commits suicide when it thinks it's 2004.

Guest Andy, it looks like you just have to change the date to 2004, and reboot to clear the virus, then you can go back to 2003.

McGrath, Blaster affects only versions of Windows AFTER '98 (2000 and XP). Welchia only affects XP.

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Dita
Date: 21 Aug 03 - 04:14 PM

The NHS lab where I work in a children's hospital had it's computer network disabled at around 16.00 today.

We're reduced to sending hard copies of urgent results via the tube system.

One can just hope that the author of the virus ends up requiring the services of a healh care service disabled by the virus.

Sorry for an unworthy thought,

John

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: McGrath of Harlow
Date: 21 Aug 03 - 04:00 PM

Am I right understanding that it doesn't affect Windows98? That's what my service provider told me anyway.

I've been getting and about messages like that with attachments every time I open my email programme the last few days. Junking them unread, of course. Maybe some of them aren't spam, but it's better not taking the risk.

It's a drag. This useful toy of ours is being destroyed before our eyes by self-important little turds.

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Bev and Jerry
Date: 21 Aug 03 - 02:47 PM

In the last three days we have gotten 71 e-mails containing the W32/Sobig-F virus/worm. Each is from the UK, has a one of several one line messages and has an attachment presumably containing the virus. A few have been returns of e-mails we allegedlly sent. Actually, these were sent using our e-mail address but, judging from the times they were sent, they were not sent from our computer.

We downloaded the latest updates from Norton and it now quarantines the attachments when they arrive. We continue to delete the actual messagaes and remove them from the deleted file.

Judging by the subject lines and the few senders we recognize, we seem to have gotten involved from a discussion group we're on (not Mudcat).

Continuing to delete, delete, delete,

Bev and Jerry

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: GUEST
Date: 21 Aug 03 - 01:31 PM

we've managed to stay up - but it's been a battle!

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: ToulouseCruise
Date: 21 Aug 03 - 01:18 PM

Our company got slammed by Welchia, by Blaster, AND by the SoBig.f or whatever it is called... all on Tuesday! I work with a national courier company and everything was down for two days, finally back up today... keep an eye out for all of em!

Brian

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: GUEST
Date: 20 Aug 03 - 06:18 PM

Hi Jeanie,
Thanks for the info. I was also infected last week, and a few weeks before with a flood of spyware causing eternal popups.
I'm frankly disgusted with those clever kids who would like to tackle Bill Gates but really cause lots of small business and organisations lots of nightmares.
I'm now in the year 2004 !

Andy

Subject: RE: Tech: W32.Welchia.Worm Virus - New !
From: Jeanie
Date: 19 Aug 03 - 08:15 PM

More about it: HERE

- jeanie

Subject: Tech: W32.Welchia.Worm Virus - New !
From: Jeanie
Date: 19 Aug 03 - 07:55 PM

In the wake of last week's worm, news just out of a new one. Symantec (Norton) are categorizing it as Level 4 severity on a scale of 1-5, so pretty serious: but there are fixes for it. It can get in through 2 different ways.

Best information I could find about it was here:
W32.Welchia.Worm

Having been one of the victims of the worm last week, thought I'd alert you to this !   According to the article above, it seems that even if you have installed the patch and eliminated last week's worm, this one can find a way in to cause problems via another route.

- jeanie