New Subject line for Swen

[Jan Il]

Hi! I have been getting a new line of the Swen e-mails, where the subject
line now says it's from Technical Support. I have not had but a few of the
others that snuck in past the Message Rules by using a one word or letter
change, but, I found 6 of these new ones just this morning. I've set my
Message Rules for this, but, I have a feeling that this is just the
beginning of a new onslaught of this thing. It is continually morphing into
new names and subjects as it goes along.

I'm not really knowledgeable about worms and viri..viru...whatever 's...but,
being the curious cat, I was wondering if this is something that is being
written anew by the senders, or if it is something that has been programmed
into the data of the whatsit to continually change like this. Or, is it
picking up things as it goes along and just changing on it's own? Not
knowing what is involved in writing such a piece of garbage, I was just
wondering if it was something that might be programmed to use the clock or
calendar of the host computer to change to whatever new name or subject it's
been triggered for before it sends out it's new poison pens.

But, it just seems as if either something is triggering it to keep changing
to keep the chain going, or someone is having a ball playing cat and mouse
by systematically changing and resending the thing with a new name or
subject line. However, the attachment is usually the same in them all. This
being the case, that is why I wondered about something written into the
thing to cause it to continue to change just the name or subject line all
the time.

Just curious, that's all. <g>

Jan

 

[Ant]

Hi! I have been getting a new line of the Swen e-mails, where the subject
line now says it's from Technical Support.

It has always an option in the worms code.

[snip]

that is why I wondered about something written into the
thing to cause it to continue to change just the name or subject line all
the time.

See here for details of strings it uses:
http://f-secure.com/v-descs/swen.shtml

 

[Jan Il]

Hi Ant!

Hi! I have been getting a new line of the Swen e-mails, where the subject
line now says it's from Technical Support.

It has always an option in the worms code.

[snip]

that is why I wondered about something written into the
thing to cause it to continue to change just the name or subject line all
the time.

See here for details of strings it uses:
http://f-secure.com/v-descs/swen.shtml

I have noticed a sudden jump in the number of the Swen messages, many with
new names and subjects. After 3 days of only a few here and there, I've had
15 in the past hour. I think this is only a drop in the bucket because of
the message rules I already have in place. But, Hotmail is taking a
tremendous hammering.

Thank you very much for the information, Ant. I truly appreciate your time
to provide this url, it does indeed answer a lot of my questions. I

Best regards,
Jan