Worm Acts with mIRC to Allow Remote Access Mass-Mailing Worm Poses as Microsoft Windows Update Esther Shein
Mass-Mailing Worm Poses as Microsoft Windows Update
Worm_Swen.A is a new mass-mailing worm that poses as a legitimate email from Microsoft Windows Update.
The emails contain an attachment with a random file name that has one of the following file extensions:
COM
SCR
BAT
PIF
EXE
The worm also attempts to propagate via peer-to-peer (P2P) file-sharing networks, such as KaZaA. It can also propagate via IRC and via newsgroups. It terminates running antivirus and firewall software.
This worm uses an old Microsoft Internet Explorer Vulnerability tackled in the Microsoft Security Bulletin (MS01-020) entitled "Incorrect MIME Header Can Cause IE to Execute E-mail Attachment." It sends some of its email messages containing an exploit to this vulnerability, causing the attachments to automatically execute whenever the messages are viewed or previewed in Microsoft Outlook or Outlook Express.
This malware is written and compiled in Microsoft Visual C++, a high-level programming language. It runs on Windows 95, 98, ME, NT, 2000, and XP.
You can view what the emails look like at this Trend Micro page.
