W32.Swen.A@mm

Note: The definitions that Symantec's Digital Immune System automatically created previously detected W32.Swen.A@mm as Worm.Automat.AHB.

Due to a decrease in submissions, Symantec Security Response has downgraded W32.Swen.A@mm to Category 2, as of March 30, 2004.

W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spread through file-sharing networks, such as KaZaA and IRC, and attempts to kill antivirus and personal firewall programs running on a computer.

The worm can arrive as an email attachment. The subject, body, and From: address of the email may vary. Some examples claim to be patches for Microsoft Internet Explorer, or delivery failure notices from qmail.

W32.Swen.A@mm is similar to W32.Gibe.B@mm in function, and is written in C++.

This worm exploits the MIME Header vulnerability (described in Microsoft Security Bulletin MS01-020) in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message.




This worm, like others, sends a fake email message that appears to have been sent from Microsoft, when it is not.

For information on how to recognize such an email, read the Microsoft article, "How to Tell If a Microsoft Security-Related Message Is Genuine."

Protection

• Initial Rapid Release version September 18, 2003
• Latest Rapid Release version January 20, 2010 revision 052
• Initial Daily Certified version September 18, 2003
• Latest Daily Certified version January 21, 2010 revision 005
• Initial Weekly Certified release date September 18, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: High
• Threat Containment: Easy
• Removal: Difficult

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High