Olympus-OM
[Top] [All Lists]

[OM] ( OM) OT New & dangerous virus; header may be "Microsoft Internet U

Subject: [OM] ( OM) OT New & dangerous virus; header may be "Microsoft Internet Update Pack"
From: "Brian Swale" <bj@xxxxxxxxxxxxxxx>
Date: Sat, 20 Sep 2003 00:10:31 +1200
W32.Swen.A@mm

Go to http://www.symantec.com and check out the link on the front page.

It came to me as a file of 150 - 200 kb (can't remember exactly). I deleted it 
before opening too deeply, It contains at least 2 gif files and the worm 
program.  

W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine 
to spread itself. It attempts to spread through file-sharing networks, such as 
KaZaA and IRC, and attempts to kill antivirus and personal firewall programs 
running on a computer.

The worm arrives as an email attachment. The subject, body, and From: 
address of the email may vary. Some examples claim to be patches for 
Microsoft Internet Explorer, or delivery failure notices from qmail.

Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, 
Windows Server 2003, Windows XP

When W32.Swen.A@mm is executed, it performs the following actions:
If the executed filename starts with the letter q, u, p, or i, the worm will 
present the user with dialog boxes that pretend to be a "Microsoft Internet 
Update Pack."

Note: The worm will install itself regardless of the choices that the user 
makes at this point.

W32.Swen.A@mm

Go to http://www.symantec.com and check out the link on the front page.

W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine 
to spread itself. It attempts to spread through file-sharing networks, such as 
KaZaA and IRC, and attempts to kill antivirus and personal firewall programs 
running on a computer.

The worm arrives as an email attachment. The subject, body, and From: 
address of the email may vary. Some examples claim to be patches for 
Microsoft Internet Explorer, or delivery failure notices from qmail.

Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, 
Windows Server 2003, Windows XP

When W32.Swen.A@mm is executed, it performs the following actions:
If the executed filename starts with the letter q, u, p, or i, the worm will 
present the user with dialog boxes that pretend to be a "Microsoft Internet 
Update Pack."

Note: The worm will install itself regardless of the choices that the user 
makes at this point.

New and dangerous virus with a header that may be "Microsoft Internet 
Update Pack"

Keep your anti-virus program up to date.

Brian

< This message was delivered via the Olympus Mailing List >
< For questions, mailto:owner-olympus@xxxxxxxxxxxxxxx >
< Web Page: http://Zuiko.sls.bc.ca/swright/olympuslist.html >




<Prev in Thread] Current Thread [Next in Thread>
Sponsored by Tako
Impressum | Datenschutz