TechSpot

New Virus Worm replicates via email, network IRC and Kazaa

By Per Hansson
Sep 20, 2003
  1. Just a few minutes ago I received a mail that looked very legitimate, it came from "Security Division" with the subject "Latest Internet Patch" when I opened it up I was greeted by the look and feel of emails Microsoft sends out:

    this is the latest version of security update, the "September 2003, Cumulative Patch" update which fixes all known security vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook Express. Install now to protect your computer. This update includes the functionality of all previously released patches.

    Of course I scanned the attachment and sure enough it was a virus, it's name was "Swen" F-Secure has rated this virus at Level 1: The highest warning a virus can get. Click this link to see an image (127kb) of the email I received. Also see MS01-020 for a fix to the vulnerability this virus makes use of. F-Secure (linked above) has free removal tools for this virus available for download.
    Swen is a mass-mailer, which was first found on Thursday, September 18th, 2003. This rather complex worm uses several different techniques to spread and can, unlike most other e-mail worms, execute automatically when an infected e-mail message is received. Swen can also, in addition to e-mail, use IRQ chat, Kazaa networks and shared folders in local area networks to spread. Original article
     
  2. StormBringer

    StormBringer TS Rookie Posts: 2,871

  3. TS | Thomas

    TS | Thomas TS Rookie Posts: 1,327

    Yeah, my wife got one of those mails yesterday. Looks fine enough until you check the message headers & all ;)
     
  4. Phantasm66

    Phantasm66 TS Rookie Posts: 6,504   +6

    Thanks very much for this. I have e-mailed all of the mortals in my department to tell them about it in terms that mortals will understand... ;)
     
  5. TS | Thomas

    TS | Thomas TS Rookie Posts: 1,327

    Email that says it's from Microsoft = Bad.
     
  6. Mictlantecuhtli

    Mictlantecuhtli TS Evangelist Posts: 4,916   +9

    "this is the latest version of security update ... which fixes all known security vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook Express."

    Mail size in Per's screenshot: 157 kB.

    I guess they've done pretty good a job then :approve:
     
  7. filkertom

    filkertom TS Rookie

    See, this is why I don't want MS to have automatic updates that you have no control over. Computers can be hacked. The mail certainly looks legit, if you just give it a glance -- but the knowledge that MS announces patches, and tells people through press releases to run the Windows Update, rather than e-mailing them, is often forgotten by non-techies, and, I'd bet, even by a few techies. Just think of what damage could be done if some unscrupulous lamer could send out an "official MS update" that you couldn't cancel.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.