Welchia I read about this in the latest issue of Scientific American, on my flight to Washington, DC. I had previously heard of the results of this worm -- but hadn't heard it's name. It was released into the wild just after the Blaster worm and the Sobig.F virus -- so while the world was busily making Blaster and Sobig.F celebrities, Welchia slipped quietly into systems. Blaster and Sobig.F were a pain. They brought down computers, affected networks and made themselves known. Welchia on the other hand, slipped in quietly and had a few profound purposes in life:

it forces the host computer to contact Microsoft's Windows Update website and download a patch for the very hole it exploits (incidentally, the Blaster worm also exploits the same hole)

it scans the host computer for the Blaster worm and removes it

it scans the local network, and attempts to procreate

It contains code that will delete itself on January 1, 2004

It installs a small file transfer server on the host.

The last bullet points to Welchia's nefarious intentions. While it appears to be a good worm, it leaves a backdoor entry for its creator. The SciAm article raises some interesting ideas -- it contends that worms are evolving to the point where they're starting to compete against one another for host systems. The article also suggests that this may be a way of combatting future malcode exploits -- creating similar code to search and destroy malicious code running rampant on the net. Pretty cool idea -- and quite Matrix-like!