Re: W32.Swen mutating?

From: Alun Jones [MS MVP] (alun_at_texis.com)
Date: 10/30/03


Date: Thu, 30 Oct 2003 19:49:56 GMT

In article <04af01c39e6b$0b584790$a301280a@phx.gbl>, "Mary" <anonymous@discussions.microsoft.com> wrote:
>All of my W32.Swen emails have referred to the October
>2003 patch. I got one today that referred to January 1997.

Probably sweN infected someone whose system clock is set wrong :-)

>My other Swen emails that say "unable to deliver message"
>are starting to completely degrade - subjects are missing
>and the grammer is getting whacky. Any chance they'll
>eventually disintegrate themselves away?

Unlikely. Most viral mutations seem to be deliberate events. Either
because someone's re-written the virus, or because the virus was originally
written to change its shape to try and avoid detection. The grammar started
off pretty whacky, from what I remember, so I don't know that you're seeing
anything terribly significant. It's always possible that you're seeing a
new strain, though. Does your AV program detect it the same?

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]

-- 
Texas Imperial Software   | Find us at http://www.wftpd.com or email
1602 Harvest Moon Place   | alun@texis.com.
Cedar Park TX 78613-1419  | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.


Relevant Pages

  • Re: what gives?? Hey Microsoft, HEL-LO....
    ... It's a virus, and as more people click on the attachment ... Take a programming course, and learn more about your system - eventually ... Texas Imperial Software | Find us at http://www.wftpd.com or email ... Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: My email (Hotmail) is sending virii ("viruses") on my behalf!
    ... Just like the people at the antivirus ... Every mail virus that you'll ever encounter picks ... Texas Imperial Software | Find us at http://www.wftpd.com or email ... Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers. ...
    (comp.security.misc)
  • Re: Why does Windows allow Worms?
    ... >>rather than any technical flaws, it would appear that the problem has ... So, to run this virus (and a huge number of people are, to judge by the ... Texas Imperial Software | Find us at http://www.wftpd.com or email ... Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers. ...
    (comp.security.misc)
  • Re: how to create new system restore point?
    ... >to use their skills in helping rather than creating viruses and victimizing ... Sadly, it takes relatively little skill to create a virus, certainly far ... Texas Imperial Software | Find us at http://www.wftpd.com or email ... Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers. ...
    (microsoft.public.security.virus)
  • Re: virus? and outlook address book
    ... You appear to be one of the earliest people to be infected by this virus. ... the number of these things that are beating down on my inbox, ... Texas Imperial Software | Find us at http://www.wftpd.com or email ... Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers. ...
    (microsoft.public.security.virus)