1. /
  2. Security Response/
  3. W32.Swen.A@mm

W32.Swen.A@mm

Risk Level 2: Low

Discovered:
September 18, 2003
Updated:
February 13, 2007 12:07:33 PM
Also Known As:
Swen [F-Secure], W32/Swen@mm [McAfee], W32/Gibe-F [Sophos], I-Worm.Swen [KAV], Win32 Swen.A [CA], WORM_SWEN.A [Trend], Worm.Automat.AHB [Previous Sym
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
CVE References:
CVE-2001-0154

Note: The definitions that Symantec's Digital Immune System automatically created previously detected W32.Swen.A@mm as Worm.Automat.AHB.

Due to a decrease in submissions, Symantec Security Response has downgraded W32.Swen.A@mm to Category 2, as of March 30, 2004.

W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spread through file-sharing networks, such as KaZaA and IRC, and attempts to kill antivirus and personal firewall programs running on a computer.

The worm can arrive as an email attachment. The subject, body, and From: address of the email may vary. Some examples claim to be patches for Microsoft Internet Explorer, or delivery failure notices from qmail.

W32.Swen.A@mm is similar to W32.Gibe.B@mm in function, and is written in C++.

This worm exploits the MIME Header vulnerability (described in Microsoft Security Bulletin MS01-020) in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message.




This worm, like others, sends a fake email message that appears to have been sent from Microsoft, when it is not.

For information on how to recognize such an email, read the Microsoft article, "How to Tell If a Microsoft Security-Related Message Is Genuine."

Antivirus Protection Dates

  • Initial Rapid Release version September 18, 2003
  • Latest Rapid Release version June 24, 2014 revision 006
  • Initial Daily Certified version September 18, 2003
  • Latest Daily Certified version October 23, 2014 revision 002
  • Initial Weekly Certified release date September 18, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: More than 1000
  • Number of Sites: More than 10
  • Geographical Distribution: High
  • Threat Containment: Easy
  • Removal: Difficult

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: High
Writeup By: John Canavan

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver