W
Will
I just got an Email It looked identical to an Email from microsoft it ciams
to be about a network security patch there is no need to click on anything
it infects your computer as soon as you recieve it below are the details
Win32:Swen
is a worm, spreading through e-mail, shared folders, Kazaa P2P network and
IRC. It switches off antiviral and personal firewall software on the
infected computers.
It fakes the "From:" field in the infected e-mails. The worm length is
106496 bytes. Being runned, the worm copies oneself to the %WINDIR% folder
(%WINDIR% is a system variable containing the name of the Windows folder.
Usually C:\Windows or C:\WinNT.) as a randomly named file. It creates files
named germs0.dbv, swen1.dat and %COMPUTERNAME%.bat (%COMPUTERNAME% is a
system variable containing the computer name.) in the %WINDIR% folder. It
searches for a number of antiviral and personal firewall programs on the
infected computer and tries to stop the found programs. It does changes to
the registry database:
It creates randomly named item in the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, with a
value referring to the worm file in the % WINDIR %. This item ensures the
worm is started with the Windows.
It sets the value of the DisableRegistryTools item in the
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
key to the "1". Thus, Windows registry database editing is disabled.
The "default" item in the HKEY_LOCAL_MACHINE\Software\CLASSES\ key subkeys
batfile\shell\open\command
comfile\shell\open\command
exefile\shell\open\command
piffile\shell\open\command
regfile\shell\open\command
scrfile\shell\open\command
is modified so, that before running any file with bat, com, exe, pif, reg or
scr extension the worm is always runned.
It creates randomly named subkey in the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\. In
the subkey these items are always created:
CacheBox Outfit="yes"
Installed="...by Begbie"
Install Item=the item from the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key
Unfile=randomly generated name of a file, containing the reference to the
%ComputerName%.bat file
These items might exist:
Email Address=the user e-mail address, obtained from the registry database
Mirc Install Folder=the folder where the MIRC system resides
Server=the SMTP server IP address obtained from the registry database
ZipName
It the Kazaa P2P system is installed, the worm adds items
Dir99= 012345:"the Kazaa shared folder name"
DisableSharing="0"
to the key HKEY_CURRENT_USER\Software\Kazaa\LocalContent.
The running worm checks, if a registry database editor is runned. If so, the
worm displays an error message and disables the editor. Periodically,
"MAPI32 Exception Error" window is displayed. The window demands input of
the mail account parameters - SMTP and POP3 server address, account name and
password, user's nickname. This is the MAPI32 Exception Error window:
to be about a network security patch there is no need to click on anything
it infects your computer as soon as you recieve it below are the details
Win32:Swen
is a worm, spreading through e-mail, shared folders, Kazaa P2P network and
IRC. It switches off antiviral and personal firewall software on the
infected computers.
It fakes the "From:" field in the infected e-mails. The worm length is
106496 bytes. Being runned, the worm copies oneself to the %WINDIR% folder
(%WINDIR% is a system variable containing the name of the Windows folder.
Usually C:\Windows or C:\WinNT.) as a randomly named file. It creates files
named germs0.dbv, swen1.dat and %COMPUTERNAME%.bat (%COMPUTERNAME% is a
system variable containing the computer name.) in the %WINDIR% folder. It
searches for a number of antiviral and personal firewall programs on the
infected computer and tries to stop the found programs. It does changes to
the registry database:
It creates randomly named item in the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, with a
value referring to the worm file in the % WINDIR %. This item ensures the
worm is started with the Windows.
It sets the value of the DisableRegistryTools item in the
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
key to the "1". Thus, Windows registry database editing is disabled.
The "default" item in the HKEY_LOCAL_MACHINE\Software\CLASSES\ key subkeys
batfile\shell\open\command
comfile\shell\open\command
exefile\shell\open\command
piffile\shell\open\command
regfile\shell\open\command
scrfile\shell\open\command
is modified so, that before running any file with bat, com, exe, pif, reg or
scr extension the worm is always runned.
It creates randomly named subkey in the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\. In
the subkey these items are always created:
CacheBox Outfit="yes"
Installed="...by Begbie"
Install Item=the item from the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key
Unfile=randomly generated name of a file, containing the reference to the
%ComputerName%.bat file
These items might exist:
Email Address=the user e-mail address, obtained from the registry database
Mirc Install Folder=the folder where the MIRC system resides
Server=the SMTP server IP address obtained from the registry database
ZipName
It the Kazaa P2P system is installed, the worm adds items
Dir99= 012345:"the Kazaa shared folder name"
DisableSharing="0"
to the key HKEY_CURRENT_USER\Software\Kazaa\LocalContent.
The running worm checks, if a registry database editor is runned. If so, the
worm displays an error message and disables the editor. Periodically,
"MAPI32 Exception Error" window is displayed. The window demands input of
the mail account parameters - SMTP and POP3 server address, account name and
password, user's nickname. This is the MAPI32 Exception Error window: