Hello all,

I am in search of a network tool that will tell me which computer on my
network is infecting other computers with the welchia worm. Does this exist?
Every time I introduce a new computer onto the network, it instantly gets
infected. Any ideas? Thanks.

Chris

Re: welchia worm removal tool by Karl

Karl
Wed Sep 17 15:34:18 CDT 2003

Go to www.microsoft.com/security and click on Blaster for information.

At a minimum, install or enable a firewall on the computer that blocks port
135 [TCP, IIRC] before putting it on the network that contains other
infected or untrusted hosts to prevent infection. Even better, apply all
the necessary patches also first. Either you've got infected computers on
your network or your firewall at your network ingress / egress points
[internet, remote access, vpn, etc.] is nonexistent or not working.
www.kerio.com is a firewall that is free for personal use. Burn whatever
patches and software you need to a CD and don't plug the network cable into
the computer [unless it's a trusted lab cable not connected to other
untrusted hosts] until the computer is fully secure. This is good practice
all the time, not just for Welchia.

Other things you should consider doing before putting computers on the
network are listed at http://securityadmin.info/faq.htm#harden

www.mcafee.com and www.sarc.com both have blaster / welchia removal tools
which should help you, but those do nothing to prevent immediate reinfection
if you haven't patched and firewalled.


"Chris Lisica" <clisica@combimatrix.com> wrote in message
news:uuLwAeVfDHA.2236@TK2MSFTNGP12.phx.gbl...
> Hello all,
>
> I am in search of a network tool that will tell me which computer on my
> network is infecting other computers with the welchia worm. Does this
exist?
> Every time I introduce a new computer onto the network, it instantly gets
> infected. Any ideas? Thanks.
>
> Chris
>
>



Re: welchia worm removal tool by Dr

Dr
Thu Sep 18 04:34:20 CDT 2003

Chris Lisica wrote:
> Hello all,
>
> I am in search of a network tool that will tell me which computer on
> my network is infecting other computers with the welchia worm. Does
> this exist? Every time I introduce a new computer onto the network,
> it instantly gets infected. Any ideas? Thanks.
>
There is a tool on the MS site to scan all machines on your network for
those that aren't patched against the worm.
You can then patch the possible suspects and run a removal tool locally to
clean them.

You can also check the logs of your routers and switches to see which ports
on the switches are the source of all the traffic.

--
Alex

"I laugh in the face of danger"

"Then I hide until it goes away"

www.drzoidberg.co.uk



Re: welchia worm removal tool by Daniel

Daniel
Thu Sep 18 11:02:10 CDT 2003

Once the "new" computer is infected it will be one of the ones spreading it
around. In other words, the computers that are infecting other computers
are all of them that are infected. I know that may sound sarcastic, but I'm
trying to point out that focusing in on one particular machine to disinfect
will be a battle you'll fight for the rest of your life.

If you really want to see what's going on though, you can use a packet
sniffer or Network Monitor. What I saw when we had welchia was each
infected machines spitting out ARP messages as fast as it could and just
spanning its network... so I would see a request to 10.0.9.11 then 10.0.9.12
then 10.0.9.13 and so on. There were hundreds of these requests per second
reaching the switch I was monitoring.

"Chris Lisica" <clisica@combimatrix.com> wrote in message
news:uuLwAeVfDHA.2236@TK2MSFTNGP12.phx.gbl...
> Hello all,
>
> I am in search of a network tool that will tell me which computer on my
> network is infecting other computers with the welchia worm. Does this
exist?
> Every time I introduce a new computer onto the network, it instantly gets
> infected. Any ideas? Thanks.
>
> Chris
>
>



Re: welchia worm removal tool by Chris

Chris
Thu Sep 18 18:11:23 CDT 2003

DR. Z-

Can you point me in the direction of this tool you're talking about? I can't
seem to find it anywhere on the site. Thanks.

Chris


"Dr Zoidberg." <AlexNOOOOO!!!!!!@drzoidberg.co.uk> wrote in message
news:bkbu7u$rbq8q$1@ID-46820.news.uni-berlin.de...
> Chris Lisica wrote:
> > Hello all,
> >
> > I am in search of a network tool that will tell me which computer on
> > my network is infecting other computers with the welchia worm. Does
> > this exist? Every time I introduce a new computer onto the network,
> > it instantly gets infected. Any ideas? Thanks.
> >
> There is a tool on the MS site to scan all machines on your network for
> those that aren't patched against the worm.
> You can then patch the possible suspects and run a removal tool locally to
> clean them.
>
> You can also check the logs of your routers and switches to see which
ports
> on the switches are the source of all the traffic.
>
> --
> Alex
>
> "I laugh in the face of danger"
>
> "Then I hide until it goes away"
>
> www.drzoidberg.co.uk
>
>



Re: welchia worm removal tool by Bill

Bill
Thu Sep 18 22:07:26 CDT 2003

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

(google is your friend--"find welchia and symantec and removal")

"Chris Lisica" <clisica@combimatrix.com> wrote in message
news:uA%23IgmjfDHA.560@tk2msftngp13.phx.gbl...
> DR. Z-
>
> Can you point me in the direction of this tool you're talking about? I
can't
> seem to find it anywhere on the site. Thanks.
>
> Chris
>
>
> "Dr Zoidberg." <AlexNOOOOO!!!!!!@drzoidberg.co.uk> wrote in message
> news:bkbu7u$rbq8q$1@ID-46820.news.uni-berlin.de...
> > Chris Lisica wrote:
> > > Hello all,
> > >
> > > I am in search of a network tool that will tell me which computer on
> > > my network is infecting other computers with the welchia worm. Does
> > > this exist? Every time I introduce a new computer onto the network,
> > > it instantly gets infected. Any ideas? Thanks.
> > >
> > There is a tool on the MS site to scan all machines on your network for
> > those that aren't patched against the worm.
> > You can then patch the possible suspects and run a removal tool locally
to
> > clean them.
> >
> > You can also check the logs of your routers and switches to see which
> ports
> > on the switches are the source of all the traffic.
> >
> > --
> > Alex
> >
> > "I laugh in the face of danger"
> >
> > "Then I hide until it goes away"
> >
> > www.drzoidberg.co.uk
> >
> >
>
>