The definitions that Symantec's Digital Immune System automatically created previously detected W32.Swen.A@mm as Worm.Automat.AHB.
Due to a decrease in submissions, Symantec Security Response has downgraded W32.Swen.A@mm to Category 2, as of March 30, 2004.
W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spread through file-sharing networks, such as KaZaA and IRC, and attempts to kill antivirus and personal firewall programs running on a computer.
The worm can arrive as an email attachment. The subject, body, and From:
address of the email may vary. Some examples claim to be patches for Microsoft Internet Explorer, or delivery failure notices from qmail.
W32.Swen.A@mm is similar to W32.Gibe.B@mm
in function, and is written in C++.
This worm exploits the MIME Header vulnerability (described in Microsoft Security Bulletin MS01-020
) in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message.
This worm, like others, sends a fake email message that appears to have been sent from Microsoft, when it is not.
For information on how to recognize such an email, read the Microsoft article, "How to Tell If a Microsoft Security-Related Message Is Genuine
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.