1. Symantec/
  2. Security Response/
  3. W32.Swen.A@mm


Risk Level 2: Low

September 18, 2003
February 13, 2007 12:07:33 PM
Also Known As:
Swen [F-Secure], W32/Swen@mm [McAfee], W32/Gibe-F [Sophos], I-Worm.Swen [KAV], Win32 Swen.A [CA], WORM_SWEN.A [Trend], Worm.Automat.AHB [Previous Sym
Systems Affected:
CVE References:

Note: The definitions that Symantec's Digital Immune System automatically created previously detected W32.Swen.A@mm as Worm.Automat.AHB.

Due to a decrease in submissions, Symantec Security Response has downgraded W32.Swen.A@mm to Category 2, as of March 30, 2004.

W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spread through file-sharing networks, such as KaZaA and IRC, and attempts to kill antivirus and personal firewall programs running on a computer.

The worm can arrive as an email attachment. The subject, body, and From: address of the email may vary. Some examples claim to be patches for Microsoft Internet Explorer, or delivery failure notices from qmail.

W32.Swen.A@mm is similar to W32.Gibe.B@mm in function, and is written in C++.

This worm exploits the MIME Header vulnerability (described in Microsoft Security Bulletin MS01-020) in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message.

This worm, like others, sends a fake email message that appears to have been sent from Microsoft, when it is not.

For information on how to recognize such an email, read the Microsoft article, "How to Tell If a Microsoft Security-Related Message Is Genuine."

Antivirus Protection Dates

  • Initial Rapid Release version September 18, 2003
  • Latest Rapid Release version August 8, 2016 revision 023
  • Initial Daily Certified version September 18, 2003
  • Latest Daily Certified version August 9, 2016 revision 001
  • Initial Weekly Certified release date September 18, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: John Canavan

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube