also @ TechSpot: Exploit allows command prompt to launch at Windows 7 login screen

TechSpot
Collaborate in the cloud with Office, Exchange, SharePoint, and Lync.
Microsoft Office 365. Pay-as-you-go starting at $8/user/month. Begin your free trial now.

New Virus Worm replicates via email, network IRC and Kazaa

Discussion in 'General Discussion' started by Per Hansson, Sep 20, 2003.

Thread Status:
Not open for further replies.

  1. Per Hansson TechSpot Server Guru

    Just a few minutes ago I received a mail that looked very legitimate, it came from "Security Division" with the subject "Latest Internet Patch" when I opened it up I was greeted by the look and feel of emails Microsoft sends out:

    this is the latest version of security update, the "September 2003, Cumulative Patch" update which fixes all known security vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook Express. Install now to protect your computer. This update includes the functionality of all previously released patches.

    Of course I scanned the attachment and sure enough it was a virus, it's name was "Swen" F-Secure has rated this virus at Level 1: The highest warning a virus can get. Click this link to see an image (127kb) of the email I received. Also see MS01-020 for a fix to the vulnerability this virus makes use of. F-Secure (linked above) has free removal tools for this virus available for download.
    Swen is a mass-mailer, which was first found on Thursday, September 18th, 2003. This rather complex worm uses several different techniques to spread and can, unlike most other e-mail worms, execute automatically when an infected e-mail message is received. Swen can also, in addition to e-mail, use IRQ chat, Kazaa networks and shared folders in local area networks to spread. Original article
    Per Hansson, Sep 20, 2003
    #1

  2. StormBringer Newcomer, in training

    StormBringer, Sep 20, 2003
    #2

  3. TS | Thomas Newcomer, in training

    Yeah, my wife got one of those mails yesterday. Looks fine enough until you check the message headers & all ;)
    TS | Thomas, Sep 21, 2003
    #3

  4. Phantasm66 Newcomer, in training

    Thanks very much for this. I have e-mailed all of the mortals in my department to tell them about it in terms that mortals will understand... ;)
    Phantasm66, Sep 21, 2003
    #4

  5. TS | Thomas Newcomer, in training

    Email that says it's from Microsoft = Bad.
    TS | Thomas, Sep 21, 2003
    #5

  6. Mictlantecuhtli TS Special Forces

    "this is the latest version of security update ... which fixes all known security vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook Express."

    Mail size in Per's screenshot: 157 kB.

    I guess they've done pretty good a job then :approve:
    Mictlantecuhtli, Sep 21, 2003
    #6

  7. filkertom Newcomer, in training

    See, this is why I don't want MS to have automatic updates that you have no control over. Computers can be hacked. The mail certainly looks legit, if you just give it a glance -- but the knowledge that MS announces patches, and tells people through press releases to run the Windows Update, rather than e-mailing them, is often forgotten by non-techies, and, I'd bet, even by a few techies. Just think of what damage could be done if some unscrupulous lamer could send out an "official MS update" that you couldn't cancel.
    filkertom, Sep 21, 2003
    #7
Thread Status:
Not open for further replies.