Welchia

Welchia, also known as the Nachi worm, was a 2003 Windows computer worm that exploited the Microsoft Windows RPC vulnerability used by Blaster. It targeted Microsoft Windows systems, particularly Windows XP, by exploiting a buffer overflow in RPC on TCP port 135, creating a remote shell, and instructing victims to retrieve the worm via TFTP.EXE; the content also notes use of TCP ports 666–765. After infection, Welchia searched for and attempted to remove Blaster by deleting MSBLAST.EXE, patched the vulnerability it had used, and attempted to download and install Microsoft security updates intended to prevent further Blaster infections. Because of this behavior it was characterized as a "helpful worm," although Microsoft stated it was not always successful in applying patches and security experts still regarded it as malware. Welchia generated ICMP traffic and in some cases flooded networks enough to cause operational problems. It was programmed to self-remove on January 1, 2004, or after 120 days. A notable impact mentioned in the content is that Welchia was discovered on the U.S. State Department network in September 2003, prompting a 9-hour shutdown for remediation.