'Swen' worm poses as security patch
Published: 18 Sep 2003 17:50 BST
Antivirus companies are warning of a new Windows worm that has the potential to spread quickly because it appears to be a legitimate security update from Microsoft.
For information on how to combat the worm, click here.
The Swen worm, known technically as I-Worm.Swen, W32/Swen.A@mm or W32/Gibe@MM.e, affects Windows 95, Windows NT and all newer versions, and spreads via email and through IRC, Kazaa and local area networks. It uses a vulnerability in Internet Explorer to execute directly from an email message, according to F-Secure. It also attempts to disable firewall and antivirus software. The worm first appeared in the wild on Thursday.
Windows users are still reeling from a series of damaging virus attacks that have caused chaos in recent weeks, partly due to the large number of Internet-connected PCs that have not patched known vulnerabilities.
One of the emails Swen uses to spread is a professional-looking message that appears to come from "MS Technical Assistance", and contains a notification of a "September 2003, Cumulative Patch", along with the virus attachment. Microsoft does not spread updates via email.
When executed, the worm continues to pose as a security update, launching a message windows that states: "This will install Microsoft Security Update. Do you wish to continue?" If the user clicks "Yes" the worm shows a fake installation dialogue box, but also installs invisibly if the "No" button is pressed.
Swen installs various files to ensure that it is launched every time the system boots up. It also disables the user's ability to edit the Registry.
Users are advised not to launch attachments. Symantec, F-Secure, Sophos, Network Associates and others have updated the definitions in their anti-virus software to prevent Swen infections.
Did you find this article useful?
96 out of 145 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
Full Talkback thread
8 comments
-
What never ceases to amaze me...is that all of the... August Valcik -
Great job. I knew it had to be a hoax at least a... Gribbly Snard
-
People People! Its very important to keep up to da... Anonymous
-
Here we go again, this spoof email is going to FOO... Curtis Zeisler
-
Better than manual update is automatic update. I... Lou
-
You can get a free fix for swen virus from
http:/... Anonymous
-
How do you know if you have the worm in your syste... john hodson
-
re: keeping up to date on definitions.
NAV set f... Steve Cornick
