Microsoft "Swen" Worm Squiggles Into Sight 789
greenhide writes "As forecast in this story, a new Microsoft worm has indeed wriggled to the surface. The W32.Swen's claim to fame is its professional looking email advertisement that pretends to be a fake Microsoft patch. Earlier viruses have made the claim, but none of them looked this good. It appears to have infected over 1.5 million machines. "
I hate this virus (Score:3, Interesting)
Oh yeah... (Score:5, Interesting)
My problem with all these worms is that it doesn't do anything after it propogates, so no one will really care except bandwidth-concious IT people. It should send itself out, then erase all the FAT tables on a hard drive.
Or deltree the c:\winnt or c:\windows directory (or both).
That would REALLY piss people off, who would demand that they do something to make sure that not happen again...like...I dunno...Linux or OSX?
Just a thought...
Weird (Score:2, Interesting)
Worm Load (Score:5, Interesting)
On the bright side, deliveries of unrelated spam seem to have fallen due to the worm's load on the internet :-)
html (Score:5, Interesting)
So, I have recieved a number of these (thank goodness I am running OS X) and it appears that the "notification" also contains html. So, examining the html, it appears that it actually references microsoft.com.
If I were microsoft, it appears there is a simple way to defeat this by inserting html in the referenced source that warns recipients of this sort of thing.
Sobig (Score:2, Interesting)
Vicious worms don't survive (Score:5, Interesting)
Yes, you could make it a little more complex with time-outs or a way to select certain targets as hosts for more sending and others to destroy, but it wouldn't last and last like some of the recent worms, because it's effects would be so noticeable.
The SPAM Connection (Score:2, Interesting)
It asks for the infected users name and email address. Great information for sending spam to.
It also asks for the users SMTP server, login name, and password. The spammer who developed this worm is looking for a way to used closed relays.
This worm is missing only 3 features, currently unreported, to be perfect. First, it should log this information and forward it in some anonymous manner (such as sending it to a few thousand people, one of whom is the desired recipient), second, second it should develop not only a list of email addresses, but also a map of who opens email sent to them by whom (so you can be sure the spam gets through), and third it should turn the comprimised computer into a distributed SPAM network relay.
Re:Fascinating isn't it? (Score:3, Interesting)
"Use Mac have no viruses affect you " ?
The users will sue apple to glory when they do come across Mac worms. Lets face it, worms will exist as long as there are worm writers. Unless ofcourse Mac and Linux blocks all incoming attachments (which is what my outlook express coincidentally did after a patch) you can't guarantee anyone against worms and ignorant people that will open them. Now security flaws in windows - thats an entirely different subject.
Re:Fascinating isn't it? (Score:5, Interesting)
I can't speak to the plumber situation, but if you've ever listened to mechanics behind the scenes, they sound *exactly* like computer techs. Sometimes they really *do* wish they could tell people they shouldn't drive a vehicle because they're idiots. (I'm betting body shop folks do even more of that sort of griping...)
Re:Reject Executable Attachements (Score:2, Interesting)
If you want to send someone an executable, send it to them in a zip or tar.gz.
All this does is moves the problem around. It's not a very good idea at all (though unfortunately it's a compelling one).
1. Soon enough, executable malware will shroud itself in a .zip wrapper (some of it already does),
and at the same time, "for convenience", new idiot-aligned (made by and for) email software will make it easy to open attachments inside zip attachments.
2. Meanwhile, it becomes harder and harder for the rest of us to use e-mail at all, as the number of proscribed message attributes grows and grows. I'm a Unix user, I want to send a fellow Unix user a script which I've placed in a file which I unthinkingly gave a name ending in ".scr", and though the file is not dangerous to me or my recipient or anyone else, it's filtered out on behalf of people who use an operating system which neither I nor my recipient use. Bleah.
The referenced header checks [securitysage.com] disallow 53 different filename extensions, all of which I now presumably have to remember to avoid using. (The problem is of course exacerbated by Windows' stubborn insistence that extension === file type.)
Re:Fascinating isn't it? (Score:3, Interesting)
Special Knoppix Boot CD needed (Score:3, Interesting)
That way you won't risk running an infected machine on the Internet and infect others.
Linux and OS X users get shafted too (Score:3, Interesting)
Anywho, I've always just shook my head and wondered why people put up with MS shiite but it's never directly affected me (indirectly, yes) until now. I am simply sick of seeing virus infected emails, emails from my ISP saying I had an email with a virus, emails from friends warning me about the latest worm even though I don't use Windows and reading stories of Mac and Linux users losing services at universities because the staff is too busy patching f*ing Windows boxes.
As most of us do, at work we use Windows. I had a project that needed to go out this week and we were pulling files over the WAN. The bandwidth was nearly zero. IT eventually found out it was a bunch of desktops in a completely unrelated office that were SMSing the remote server I was accessing to death but they didn't have time to fix it because they were too busy fighting virii on the west coast. Project gets delayed.
I hate them. I want to see Linux kill Microsoft. Their ill-gotten reign must end. The Penguin must draw and quarter Bill & Co. and burn their remains. I am tired of having to be bothered by Windows and their sheep-like user-herds. I want to use my Mac without having it affected by the crap that spews out of Redmond. I want to know why people aren't looking at Macs and Linux more seriously. I want to know why Apple and IBM are siezing the moment and using this time to educate the masses. I want to know why the MCSE monkeys continue to be blind to the failure of thier preferred OS.
BTW, as you know, I really want Linux to annihilate MS, just don't kill Apple in the process, I like them
Re:Huh? (Score:2, Interesting)
You have to open the attachment.
Microsoft never e-mails patches or provides a direct, embedded link to an upgrade or patch. Open Source projects like 7-Zip do, I received one this morning, so don't get too cocky, you could be sucked in real easy.
Re:Huh? (Score:3, Interesting)
True. This can happen in Linux too, though. I seem to recall Lindows gives users root by default, and from my small experience with SuSE, they seem to have something similar with being able to "save" your run-as-root permissions for apps.
Re:Huh? (Score:3, Interesting)
I will agree with you that windows takes ease-of-use over security, though XP and 2003 have taken steps to prevent that. One thing that does cheese me off about windows though, is the fact that programs often have more power than the users that run them. Personally, I don't believe anything should have free run of the registry to dump any of its crap in there.
Re:Huh? (Score:2, Interesting)
I know that it is hard to believe, but it is possible to have a Windows machine connected to the internet without ever getting a virus. I've never had a virus infect my work PC, which has been connected to the internet since 1997. It's a matter of using common sense: Don't open email from people you don't know (mostly spam). Don't open email in a reader that will automagicly execute whatever it opens (ie: unpatched outlook). Download files from trusted sources, don't run every app that comes your way, keep up to date on the patches, and run your computer behind a firewall. If you do that, you might not even need to have a virus scanner running all the time. (Though I don't recommend this if your running any sort of business, or routinely let unknown computers connect to your network)
At home I don't have a virus scanner installed on any of my computers. Every once in a while, I'll download the latest dats from mcafee and run the command line scanner, but so far its been a waste of time, as it hasn't caught anything yet. At work, I have the corporate mandated Norton, and have yet to receive an infected file, but the risk at work is more then at home, so it makes sense.
I do fully realize that I am running a risk at home, and with the latest round of viruses, I am tempted to get a virus checker going on the old home PCs, just to be on the safe side. Like most people I'm a firm believer in it can't happen to me
Sigh. Alright, where are the Feds? (Score:2, Interesting)
To add insult to injury I haven't run an MS OS since about 1998 - only Linux, OBSD, & OSX.
I've had to deal with the effects of *others* carelessness and ignorance for *years* now. Lost productivity (I telecommute), the inconvenience, all my extra time having to tweak my firewall, and all the bandwidth that was rightfully mine that was stolen, the load on my mail server. That times the 100M (or whatever it is) people on the net.
If Ford made a car that was this poorly made consumers could sue them. At the very least the Feds would step in and force a recall.
So why haven't the Feds forced a Microsoft recall? Why have there been no class action suits for repeatedly defective products?
If Windows really does have 92-95% of the desktop market then it's a critical resource and should be treated as such. The Feds would never allow a phone system to continue if it crashed every month, or a rail system that had a major accident every month. It goes against national security.
If MS has that much market-share then they should be treated as a critical system just like phones or rail and held to the same standards.
Re:Linux and OS X users get shafted too (Score:1, Interesting)
Remind me - what does Microsoft lose out of all of this?
Lucky windows users??? Re:Huh? (Score:1, Interesting)
I have been receiving dozens of copies of this virus in my inbox over the last two days. They look pretty in my kmail spam folder. I usually delete spam from the folder, but they are so pretty I have decided to archive a few of them...
I read many comments by windows users who say they have used it for so many years and never had a virus, because they are sensible users who patch their OS and never open attachments...
It may be they are lucky too...
My brother wrote me yesterday to tell me that his XP box got infected and that of my father too. With both computers, he tried to reinstall XP and go straight to download the patch but, so he tells me, with both computers he got re-infected within 3 minutes of reinstalling the OS. He never got a chance nor the time to download the patch...
I am sure that my brother didn't open any attachment with any fucking v***us (oops, I meant f***ing virus) within three minutes of installing XP.
There must be something right that virus writers are doing... and MS must be doing something wrong.
Meanwhile, POPFile carries on marking those nice looking emails as viruses which Kmail then happily filters out of my way...
Re:And all 1.5 million (Score:4, Interesting)
I know how you feel. I was getting them at a rate of 1 or 2 every 10 minutes. Ugh. If you happen to be running SpamAssassin, I've got rules that seem to take care of it. Luckily for you, but unluckily for me, I was hit starting on Thursday, so I've had days to tweak the rules.
Check them out at my web site [infofiend.com]. Feel free to add comments and tweaks there. Oh, and in case you're using maildrop, you can apparently choose not to deliver the message by using if ($MAIL_IS_SPAM) { exit }
So now my own server is spam free, but unfortunately even though I use Linux at work, the mail server is an Exchange server so... *sigh*
My e-mail server (Score:3, Interesting)
The e-mail is very deceptive and looks like real e-mail sent from Microsoft. Other than being a pain in the ass it's almost as fun as being
Re:Special Knoppix Boot CD needed (Score:2, Interesting)
Indeed. IMO, read/write support for NTFS is one of the top three most
overdue features the Linux kernel needs. A versioned filesystem (a la
what VMS has, but built from the ground up for Linux) is another. I'm
sure there's a third feature as long overdue as these two, but I don't
know what it is.