Note: The definitions that Symantec's Digital Immune System automatically created previously detected W32.Swen.A@mm as Worm.Automat.AHB.
Due to a decrease in submissions, Symantec Security Response has downgraded W32.Swen.A@mm to Category 2, as of March 30, 2004.
W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spread through file-sharing networks, such as KaZaA and IRC, and attempts to kill antivirus and personal firewall programs running on a computer.
The worm can arrive as an email attachment. The subject, body, and
From: address of the email may vary. Some examples claim to be patches for Microsoft Internet Explorer, or delivery failure notices from qmail.
W32.Swen.A@mm is similar to
W32.Gibe.B@mm in function, and is written in C++.
This worm exploits the MIME Header vulnerability (described in
Microsoft Security Bulletin MS01-020) in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message.
This worm, like others, sends a fake email message that appears to have been sent from Microsoft, when it is not.
For information on how to recognize such an email, read the Microsoft article, "
How to Tell If a Microsoft Security-Related Message Is Genuine."
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
