Another Hoax

[Treeskier]

I'm being absolutely bombarded by email ( about 2 every 5 minutes or less
all day) from "MS Network Security Center" subject "Newest Network Security
Pack" and then followed by another email, undeliverable mail notification
with an attachment. My second computer is just now starting to receive
these.
DON'T OPEN THEM unless you think your anti-virus program doesn't stink!
Anyone else getting these all day???

 

[W????n S.]

I'm being absolutely bombarded by email ( about 2 every 5 minutes or less
all day) from "MS Network Security Center" subject "Newest Network Security
Pack" and then followed by another email, undeliverable mail notification
with an attachment. My second computer is just now starting to receive
these.
DON'T OPEN THEM unless you think your anti-virus program doesn't stink!
Anyone else getting these all day???

Nice world we are in eh?????????/

 

[GSV Three Minds in a Can]

I'm being absolutely bombarded by email ( about 2 every 5 minutes or less
all day) from "MS Network Security Center" subject "Newest Network Security
Pack" and then followed by another email, undeliverable mail notification
with an attachment. My second computer is just now starting to receive
these.
DON'T OPEN THEM unless you think your anti-virus program doesn't stink!
Anyone else getting these all day???

Dozens. Which just goes to show how many open machines and dumb users
are still out there. Read the NG .. plenty of comments on it (SWEN.A ..
or GIBE.F, or whatever you want to call it). My AV program picks it up,
but only after updating to today's definition file .. however it is
pretty obviously a virus, you can see that by eyeballing it.

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

PSS Security Response Team Alert - New E-Mail Worm: W32/Swen@MM

SEVERITY: MODERATE
DATE: September 18, 2003
PRODUCTS AFFECTED: Microsoft Outlook, Microsoft Outlook Express, and
Web-based e-mail

**********************************************************************

WHAT IS IT?
W32/Swen@MM spreads via e-mail and network shares. The Microsoft
Product Support Services Security Team is issuing this alert to advise
customers to be on the alert for this virus as it spreads in the wild.
Customers are advised to review the information and take the appropriate
action for their environments.

IMPACT OF ATTACK: Mass Mailing, disabling processes related to security
software such as antivirus and firewall software

TECHNICAL DETAILS:
For additional details on this worm from anti-virus software vendors
participating in the Microsoft Virus Information Alliance (VIA) please
visit the following links:

Network Associates:

http://vil.nai.com/vil/content/v_100662.htm

Trend Micro:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SWE
N.A

Symantec

http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
ml

Computer Associates:

http://www3.ca.com/virusinfo/virus.aspx?ID=36939

For more information on Microsoft's Virus Information Alliance please
visit this link: http://www.microsoft.com/technet/security/virus/via.asp


Please contact your Antivirus Vendor for additional details on this
virus.


PREVENTION:

1. This worm is exploiting a previously patched vulnerability. The
vulnerability exploited is related to the following Microsoft Security
Bulletin:
http://www.microsoft.com/technet/security/bulletin/ms01-020.asp

As always, customers are advised to install the latest security patch
for Internet Explorer. Information on the latest cumulative security
patch for
Internet Explorer can be found here:
http://www.microsoft.com/technet/security/bulletin/MS03-032.asp

2. Outlook 2000 post SP2 and Outlook XP SP1 include the most recent
updates to improve the security in Outlook and other Office programs.
This includes the functionality to block potentially harmful attachment
types. If you are running either of these versions, they will (by
default) block the attachment, and you will be unable to open it.

To ensure you are using the latest version of Office click here:
http://office.microsoft.com/ProductUpdates/default.aspx

By default, Outlook 2000 pre SR1 and Outlook 98 did not include this
functionality, but it can be obtained by installing the Outlook E-mail
Security Update. More information about the Outlook E-mail Security
Update can be found here:

http://office.microsoft.com/Downloads/2000/Out2ksec.aspx

Outlook Express 6 can be configured to block access to
potentially-damaging attachments. Information about how to configure
this can be found here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q291387

Outlook Express all other versions: Previous versions of Outlook Express
do not contain attachment-blocking functionality. Please exercise
extreme caution when opening unsolicited e-mail messages with
attachments.

Web-based e-mail programs: Use of a program-level firewall can protect
you from being infected with this virus through Web-based e-mail
programs.

RECOVERY:
If your computer has been infected with this virus, please contact your
preferred antivirus vendor or Microsoft Product Support Services for
assistance with removing it.

TECHNET SECURITY LINK:
http://www.microsoft.com/technet/security/virus/alerts/swen.asp

As always please make sure to use the latest Anti-Virus detection from
your Anti-Virus vendor to detect new viruses and their variants.

If you have any questions regarding this alert please contact your
Microsoft representative or 1-866-727-2338 (1-866-PCSafety) within the
US, outside of the US please contact your local Microsoft Subsidiary.
Support for virus related issues can also be obtained from the Microsoft
Virus Support Newsgroup which can be located by clicking on the
following link
news://msnews.microsoft.com/microsoft.public.security.virus.

PSS Security Response Team

--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -

 

[C Clemans]

PSS Security Response Team Alert - New E-Mail Worm: W32/Swen@MM

I have removed the virus file. I need to edit the registry and remove
the entries in created. It has locked me out from editing.

How do I get the edit option back?

Thanks

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

Special thanks go to Doug Knox MS-MVP for the following workaround:

Do the following:

Click Start, Run and enter CMD to open a Command Prompt window.
Then copy and paste the following commands into the Command Prompt window.

COPY %WINDIR%\System32\Taskmgr.exe %WINDIR%\System32\Taskmgr1.exe
COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM
COPY %WINDIR%\PCHealth\HelpCtr\Binaries\MSCONFIG.EXE
%WINDIR%\PCHealth\HelpCtr\Binaries\MSCONFIG1.EXE

Then you can use the new file names to get into these utilities to use them
to help your troubleshooting.

--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -

 

[Treeskier]

I stand corrected! You're right! It isn't a hoax but a real virus!

 

[W????n S.]

x-no-archive: yes


(e-mail address removed)

Fire away!

I use Mailwasher.
I have yet to receive one in my inbox.
I also try to deter SPAM.
I never open attachents even from people I know.
Silly people.
Paranoid me.

: )

 

[Gary P]

Unfortunately some of us in business use email precisely because we need to
receive attachments from people. Sneindg and receiving documents is a large
part of my work as a journalist.

Or even "Sending and receiving...."

Gary

 

[Jim Macklin]

When I send or receive an attachment I include a "cover
letter" in the form of another email that describes exactly
what the attachment is, size, content, etc. If I get one I
send an email asking for confirmation or I make a phone call
to the sender.

When in doubt I delete the email.

I delete about 85% of the email that I get in my mail.


| |
| > I never open attachents even from people I know.
|
| Unfortunately some of us in business use email precisely
because we need to
| receive attachments from people. Sneindg and receiving
documents is a large
| part of my work as a journalist.
|
| I think we need to ask people to make the programmes safe
rather than
| willingly give up that functionality.
|
| I use Mailwasher, Norton Internet Secuurity, Norton
Anti-virus, Windows
| updates, and - maybe most importantly - also a dose of
common sense.
|
|

 

[Les Herrman]

Hmmm... I feel left out; I've not gotten a single one.

Count yourself lucky.

Fortunately I know better than open an attachment to an email.

And Comcast has now caught up their BirghtMail anti virus and are no
longer delivering the thing to me. (However I do get an email saying
I didnt get it cause it was cleaned by their email virus checking so I
just might as well have gotten the original)

 

[djs]

x-no-archive: yes

Just as a preview tool. What, you think I use it for some sort of
psychic anti virus detector........................

Yeah, it's great software... blacklisting and bouncing really work, and
they don't cause more problems than they solve.

Go to Hell

I'm there already, and I'll see you soon!

 

[djs]

x-no-archive: yes

Count yourself lucky.

Fortunately I know better than open an attachment to an email.

And Comcast has now caught up their BirghtMail anti virus and are no
longer delivering the thing to me. (However I do get an email saying
I didnt get it cause it was cleaned by their email virus checking so I
just might as well have gotten the original)

The solution is to use myrealbox.com... Between their ultra-aggressive
spam and virus filters, and the fact that they have outages and problems
99% of the time, you'll never get a *single* problematic email!

 

[GSV Three Minds in a Can]

We have been told by the MVP who runs our mvps.org mail service, that
his mail server has been getting 20 of them *a second* and he is having
to take special steps to block the flood before it ever arrives

One major problem too is that the message is quite big - people's mail
boxes at POP server have been clogging up. A true can of worms

Yep .. apparently this worm (note - Swen = News backwards?) harvests all
the emails it can find in .dbx, .mbx, .wab, .htm etc. files on infected
PCs. That means it =will= get 'reply to' and 'sent by' addresses from
postings that have been downloaded to that PC. These addresses are not
available to normal spammers (unless they download the whole messages,
which they won't have done), and many ISPs require them to to actually
be valid (even if 'from' is munged).

I'd like to revisit the death penalty on this one .. 8>.