[an error occurred while processing this directive]
BBC News
watch One-Minute World News
Last Updated: Tuesday, 19 August, 2003, 11:18 GMT 12:18 UK
New web worm tackles bugs
Windows XP on sale, PA
The new worm targets Windows XP
Another Windows worm is on the loose, but this one tries to help rather than hinder.

The Welchi or Nachi worm is using the same trick as last week's disruptive MSBlast virus to travel around the net but tries to fix vulnerable machines rather than exploit them.

The Nachi worm tries to automatically apply the software patch issued by Microsoft to secure machines against the attentions of MSBlast.

If the Nachi virus finds the MSBlast worm on a PC it removes the malicious program.

"The writer of the Nachi worm may want to be seen as the Dirty Harry of the internet world, cleaning up malicious MSBlast code wherever it is found," said Graham Cluley, senior technology consultant at anti-virus firm Sophos.

Aid program

Last week many thousands of net connected Windows PCs fell victim to the MSBlast worm which exploited a month old security loophole to infect machines.

Since it made its appearance, the MSBlast worm is thought to have infected more than 500,000 machines.

Many machines were due to launch a denial-of-service attack on Microsoft's Windows Update site on Saturday but the software giant said it had managed to dodge the assault.

In the wake of MSBlast, the Nachi worm is prowling the net looking for machines with the vulnerability exploited by the more disruptive program.

Once it finds a vulnerable machine, Nachi tries to download the patch Microsoft created to make PCs invulnerable to MSBlast-type viruses.

Nachi also tries to put the correct language version of the patch to any machine it has reached.

MSBlast targeted many different versions of Windows, but Nachi only seeks out and fixes vulnerable machines running Windows XP.

The worm will also uninstall itself after 1 January 2004.

The Nachi/Welchi worm was described as an "anti-virus virus" by Mikko Hypponen, director of anti-virus research at security firm F-Secure.

"We've seen similar things before, but not to the extent of actually applying Microsoft's own patches to the system," he said.

"Unfortunately Welchi is not perfect and will create some additional problems."

He said the Welchi/Nachi worm could cause problems because it was untested, installed itself automatically, had the potential to cause compatibility problems and created lots of unwanted net traffic.




SEE ALSO:
Internet worm threat 'thwarted'
16 Aug 03  |  Technology
Worm blasts across the web
12 Aug 03  |  Technology
Home users suffer web worm woe
13 Aug 03  |  Technology
Net security threats turn devious
08 Aug 02  |  Technology
Wiping out the web worm
14 Aug 03  |  Technology
Cheese beats crackers
22 May 01  |  Science/Nature
Net recovers from cyber attack
27 Jan 03  |  Technology


RELATED INTERNET LINKS:
The BBC is not responsible for the content of external internet sites


PRODUCTS AND SERVICES

News Front Page | Africa | Americas | Asia-Pacific | Europe | Middle East | South Asia
UK | Business | Entertainment | Science/Nature | Technology | Health
Have Your Say | In Pictures | Week at a Glance | Country Profiles | In Depth | Programmes
Americas Africa Europe Middle East South Asia Asia Pacific