Re: virus swen cured then the same effects come back?
From: Phil Weldon (pweldon_at_mindspring.com)
Date: 10/03/03
- Next message: Gary: "Swen spread from this site"
- Previous message: Jeff Cochran: "Re: Trackers Second Review Response"
- In reply to: paul cheetham: "virus swen cured then the same effects come back?"
- Next in thread: Kent W. England [MVP]: "Re: virus swen cured then the same effects come back?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 03 Oct 2003 14:48:50 GMT
Clearly your system is still infected.
#1. Run a remote virus scan from the website of a publisher of antivirus
programs.
#2. Install an antivirus program from a CD-ROM.
#3. Install all appropriate Microsoft security patches and Service Packs.
#4. Run the anti-virus program, then remove or repair any infections found.
#5. Repeat # 4. until your system gets a clean bill of health.
#6. If #5. Does not bring relief, do a repair install of your operating
system.
If this does not work, as soon as possible, take your system to a computer
repair shop, buy a new antivirus program, and pay the shop to install the
antivirus program. Do this quickly, before computer repair shops discover
how labor intensive it has become to successfully install an antivirus
program on an infected system.
[ Symantec, the publisher of Norton AntiVirus, has a description of the
worm, how to remove it, and removal tools at
http://www.symantec.com/avcenter/venc/data/w32.swen.a@mm.html . Other
publishers of antivirus programs have similar webpages. Note well, removing
this worm after your system has been infected is not a simple task.]]
This worm has two main effects, and some secondary effects
I. Main effects
A. It infects vulnerable systems and networks.
B. It generates a FLOOD of infected e-mail that is sent to e-mail
addresses it harvests from infected machine and networks. These infected
e-mails are of two types
1. An HTML message that looks like a legitimate Microsoft Security
Bulletin; the hotlinks in this message are valid Microsoft links, and will
even lead you to a description that will allow you to identify this e-mail
as bogus. The message has an attached 104 KByte file that contains the
worm. If you don't have all appropriate Microsoft security patches and
Service Packs installed, it may be possible for your system to be infected
EVEN IF YOU DON'T OPEN THE MESSAGE. So far, the body of this message is
always the same, though the Subject and From lines differ widely. This
message, so far, can be easily be blocked by detecting the string 'Run
attached file' in the body ( in fact, it would be a good practice to
consider ANY e-mail that contains this string AND has an attachment to very,
very likely to carry an infection.
2. A plain text message that purports to be a notification of an
'Undeliverable e-mail', with an attachment that purports to be a copy of the
undeliverable e-mail; this attached file is 104 KBytes long and contains the
worm. The Subject line, From line, and body present in thousands of
combinations, and probably will continue to mutate. Even worse, real e-mail
addresses harvested from infected systems and networks are tagged onto this
type of message, causing one of the secondary effects.
II. Secondary effects
A. Spam effect
1. Mailboxes with an e-mail address that has been harvested from
infected systems and networks begin to be flood with infected e-mail.
[Personal example: my machines are not infected, but this worm began to
flood my mailbox 17SEP03. I now receive more than 1500 infected e-mail
messages per day. I must empty my mailbox every 5 minutes, 24/7 to avoid
the possibility of having legitimate e-mail bounced. I had to install an
application just to segregate the cleaned, previously infected e-mail
from legitimate e-mail (standard spam blockers can't do this.)
B. Notifications from mail services that DO scan for infected
messages, but unfortunately do not realize that the e-mail addresses given
for the sender are either bogus or e-mail addresses harvested by the worm.
Thus, completely innocent mailboxes have insult added to injury.
****
What can you do locally as an individual (i.e. in a SmallOfficeHomeOffice
environment, and /or as a recreational user)?
#1. You can use a remote virus scan from one of the antivirus program
publishers
THEN
#2. You can remove any infections discovered
THEN
#3. You install a good antivirus program, keep it active, keep the virus
definitions up-to-date (at the moment you should update these definitions
EVERY day), and set to scan all incoming e-mails and downloads.
THEN
#4. You can install all appropriate Microsoft security patches and Service
Packs.
THEN
#5. You can consider additional security (DCHP server, firewall, boric acid
[for roaches], .....
If you begin to be flooded with these infected messages, COMPLAIN to your
ISP; send them this URL
http://xtra.co.nz/products/0,,8969,00.html of an ISP that scans incoming
e-mail before passing it to a mailbox. Ask for an increased mailbox size
(if you are getting 1500 of these infected e-mails per day, you will need a
mailbox size over 150 MBytes just to avoid the necessity of completely
emptying it EVERY DAY. Ask about the implicit duty of the ISP to provide
reliable e-mail service, and if they have received notification of any
pending class actions you might join. Ask if they will unbundle their
services so you can opt out of e-mail service and save that cost. That's
about
all you can do about the e-mail flood; only your ISP or other e-mail
provider can come close to solving this problem.
When the e-mail flood becomes too painful, find an ISP or other e-mail
provider that DOES scan and discard infected e-mail before passing it to
your mailbox, and then change to that ISP and/or e-mail provider. Changing
your e-mail address is no solution; as soon as your new e-mail address is
harvested from an infected system or network, the problem starts again.
When a mailserver is scanning and not just deleting infected e-mail, but is
also sending an e-mail to notify the sender, write the administrator a nasty
note asking them to stop sending these notices.
****
That's about it; you can proof your system against infection, but only
changes at the mailserver level can stop reception of a flood of infected
e-mails and increasing numbers of inappropriate notices that you've sent
infected e-mail.
Phil Weldon, pweldon@mindspring.com
"paul cheetham" <cheets70@hotmail.com> wrote in message
news:0fa701c38989$f1515530$a401280a@phx.gbl...
> I recently followed the guides from this group and got
> back to normal after SWen.
> All of a sudden;
> I cannot open applications .exe etc as the open command
> was replaced with Quick heal virus scan
> The file was scanned and did not open
> I went to the folder options and sure enough Applications
> were now opened with Virus scan
> I uninstalled Quick heal
> Went back to re set but the edit function does not come
> live and I cannot enter the open command.
> Tried the Symantec guide re SWen regedit etc did not work
> Tried to set up new folder options for applications
> I have scanned the system and No viruses are found.
>
> Any ideas on how to restore??
> Paul C
> Bath UK
- Next message: Gary: "Swen spread from this site"
- Previous message: Jeff Cochran: "Re: Trackers Second Review Response"
- In reply to: paul cheetham: "virus swen cured then the same effects come back?"
- Next in thread: Kent W. England [MVP]: "Re: virus swen cured then the same effects come back?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
