Alias:W32/Welchia.worm10240, W32/Nachi.worm, WORM_MSBLAST.D,Lovsan.D, W32/Nachi-A, Win32.Nachi.A, Worm.Win32.Welchia, W32.Welchia.Worm
Type:Worm 
Size:10,240 Bytes 
Origin:unknown 
Date:08-18-2003 
Damage: 
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:Medium 

Technical DetailsWhen opened, Nachi.A.1 copies itself as C:\%SystemDIR%\Wins\Dllhost.exe. It makes a copy of C:\%Systemdir%\Dllcache\Tftpd.exe, named C:\%System%\Wins\svchost.exe.

It makes the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service RpcPatch RpcTftpd

It sets the service:

Service Name: RpcTftpd
Service Display Name: Network Connections Sharing
Service Binary: %System%\wins\svchost.exe

This service is manually started.

Service Name: RpcPatch
Service Display Name: WINS Client
Service Binary: %System%\wins\dllhost.exe

This service is automatically started.

It terminates "Msblast" process and deletes the file C:\%SystemDIR%\msblast.exe.

Then it chooses IP addresses in two modes: The worm uses the infected computer's IP A.B.0.0, or it composes an IP address out of encoded ones. After choosing the start address, it uses a class B network. It sends a CMP reply or PING, to verify if the chosen IP address corresponds to an active computer on the network.

It starts the TFTP Server on the attacked computer and downloads Dllhost.exe and Svchost.exe on it. When the update is downloaded and run, the worm restarts the computer, to install the correction routine.

It verifies the system date. In the year 2004, the worm deletes the file C:\%SystemDIR%\Wins\Dllhost.exe and the services RpcPatch and RpcTftpd, and removes the registry entries:
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcPatch
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcTftpd
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .