http://www.theregister.co.uk/content/56/32925.html


Nasty worm poses as MS security update
By John Leyden
Posted: 19/09/2003 at 08:03 GMT

Windows users were yesterday warned of the appearance of a worm that poses as a security update from Microsoft but actually causes all manner of mischief on infected PCs.

Swen-A (AKA Gibe-F) is a mass-mailing worm that also attempts to spread through file-sharing networks, such as KaZaA and IRC, and over local area network shares. The worm attempts to de-activate antivirus and personal firewall programs running on an infected computer.

AV vendors warn that the worm is spreading rapidly and that disinfection is difficult. As usual this is a Windows-only menace Linux, Macintosh, Microsoft OS/2 and Unix users are immune.

Swen-A uses a well known vulnerability in Internet Explorer to execute directly from e-mail. Windows users can also catch the pox by executing an infected email attachment.

Finnish AV firm F-Secure compares the worm to Gibe, and believes it is likely that the same author wrote both worms.

Swen-A (like Gibe and numerous other viruses before it) purports to be a security alert from Microsoft. This time around infectious messages come with a well-presented HTML message complete with graphics that are more likely to trip up the unwary.

The worm can also impersonate mail delivery failure notices, attaching itself as a randomly named executable.

Swen-A attempts to spread by emailing itself using its own SMTP client to addresses extracted from various sources on the victim's drives (e.g.MBX and DBX files). Periodically the worm presents users with a fake MAPI Exception error, prompting them to enter the details of their email account (name, user name, servers).

Sneaky.

Swen-A also makes modifications which make it hard to run Reg Edit,
along with other changes to infected PCs explained in advisories from F-Secure and Symantec.

Windows users are advised to update the virus signature files on their AV scanners to defend themselves against the worm, which is all very well but the reason the virus got a hold in the first place is probably because of the shortcomings of the scanner model.

You have been warned...
Windyboy

 

Ooooooooooh! I'd love half an hour in a locked room with the sort of people who write these things.WTF do they get out of it? sad fekkers!!
I've only just got rid of that last b@st@rd worm, Welchia, was it??
Alcazar:

 

keeps us all in a job though mate

shunty

 

when will people stop opening unknown atachments in emails from unrecognised adresses??

 

Thanks for the warning.

 

I NEVER open email from addresses i dont know.

BUT..... the other day i got one subject; Undelivered Message (or something similar)... Sender: MAILER-DAEMON.

I couldnt remember the exact senders details for a genuine returned email and clicked it

It was some advertising crap. But it DID catch me out.

 

$hit i had that sent to me today

 

1st came up as an undelivered mail?

Then a link to MS?

I did not open as i thought it was strange

Have done a virus sweep and all is fine

 

Yep had this at work

Norton AV caught the virus in the attachment.

 

Thanks for the tip

Les

 

Yep I got that this morning