BlueWolf's Howl

« Routing all the way... | Bluewolf's Howl | DHS is Making Friends »

September 19, 2003

Here we go again...

We have another chart-topper mass-mailing worm that is gaining momentum...

This one is called W32.Swen.A@mm. I've already quarrantined 5 of them and I don't usually see this stuff at home. Due to a recent increase in submissions, it is now a Category 3 threat.

W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spread through file-sharing networks, such as KaZaA and IRC, and attempts to kill antivirus and personal firewall programs running on a computer.

On its heels is the W32.Yaha.AA@mm, which is currently at a Category 2. This one has a really nasty payload:

Terminates some antivirus and firewall processes.

Installs a keylogger and emails the logs to its author.

Contains a destructive payload that may be triggered if the system time zone is GMT+5.

If you have "Live Update" set to keep your definitions current, that's great. But, you still may be a day or two behind the latest download. If you look at the smaller print on the Symantec site:

Intelligent Updater definitions are released daily, but require manual download and installation.
LiveUpdate virus definitions are usually released every Wednesday.

The LiveUpdate refers to the automatic updates that your Antivirus program uses. Even if you set it to check daily for new updates, the available file is not updated that frequently. The Intelligent Updater files are released more frequently. As found on the Symantec site:

Intelligent Updater:
Virus Definitions created September 19
Virus Definitions released September 19

LiveUpdate:
Virus Definitions released September 18

As you can see, the automatic updates are a day behind. So...Go! Download! Install! And sleep soundly.

Posted by BlueWolf on September 19, 2003 06:40 PM