Swen Worm Spreads Quickly

[The Finman]

<APPLET CODE="NewsTicker.class" CODEBASE="http://ticker.ap.org/ticker5" WIDTH="750" HEIGHT="18" ALT="UpToTheMinuteNews" ALIGN="top">
<PARAM NAME="copyright" VALUE="Detlef Beyer">
<PARAM NAME="offh" VALUE="740">
<PARAM NAME="offv" VALUE="18">
<PARAM NAME="imgh" VALUE="10">
<PARAM NAME="imgv" VALUE="5">
<PARAM NAME="imghb" VALUE="2">
<PARAM NAME="imgvb" VALUE="0">
<PARAM NAME="size" VALUE="12">
<PARAM NAME="style" VALUE="BOLD">
<PARAM NAME="font" VALUE="Times">
<PARAM NAME="spot" VALUE="yes">
<PARAM NAME="lines" VALUE="1">
<PARAM NAME="pause" VALUE="0">
<PARAM NAME="animtype" VALUE="13">
<PARAM NAME="debug" VALUE="no">
<PARAM NAME="gifon" VALUE="no">
<PARAM NAME="ranstart" VALUE="no">
<PARAM NAME="path" VALUE="http://ticker.ap.org/ticker5/txt/ticker.txt">
<PARAM NAME="background" VALUE="000000">
<PARAM NAME="textcolor" VALUE="00ff00">
<PARAM NAME="spotcolor" VALUE="ffcc33">
<PARAM NAME="reload" VALUE="yes">
<PARAM NAME="speed" VALUE="3.0">
<PARAM NAME="break" VALUE="no">


</APPLET>
<h2><font color=#003399>Swen Worm Spreads Quickly</font></h2>
Security experts say that the Swen mass-mailing Windows worm appears to be spreading quickly, moving to the top of the virus charts a day after it first appeared--and even maintaining its own counter that supposedly monitors how many PCs have been infected.

For information on how to combat the worm, click here.

It takes advantage of a two-year-old Internet Explorer flaw that allows it to execute directly from an e-mail message without the help of the user.

The first time the worm executes on a system, it contacts a Web address and updates a counter that supposedly indicates how many machines are infected--although antivirus vendors doubt that the figure is correct.

Antivirus vendors upgraded their assessment of Swen's threat on Friday, due to the increase in infections.

Symantec, for example, shifted Swen up to a category 3 virus.

Swen in part relies on a flaw Microsoft first disclosed in a 2001 security bulletin, although it can also be spread by duping users into executing its attachment.

When executed, the worm continues to pose as a security update, launching a message window that states: "This will install Microsoft Security Update.

If the user clicks "Yes", the worm shows a fake installation dialogue box, but also installs invisibly if the "No" button is pressed.

Swen installs various files to ensure that it is launched every time the system boots up.

Users are advised not to launch attachments without first scanning them with antivirus software. For more information, see Central Command, Computer Associates, F-Secure, McAfee, Norman, Sophos, Symantec, and Trend Micro


Full Article <font color="red"><u>Here</u></font>

[Taxman]

Ok Fin, this is probably a stupid question but: What's the difference between a worm and a virus?

[Edith Piaf]

a worm is smaller and is programme written to destroy some files, but i think que virus is larger programme et designé to destroy main hard drive. please correct if i have wrong