# MA-057.092003: MyCERT Advisory - W32.Swen@MM Worm Masquerading as Microsoft

**Date:** 22 Sep 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-057.092003  
**Advisory ID:** MA-057.092003

---

MyCERT received information regarding a new worm, the W32.Swen@mm worm, also known as W32/Gibe.E which comes as an email attachment masquerading as Microsoft's patch, the "September 2003, Cumulative Patch" for MS Internet Explorer, MS Outlook and MS Outlook Express.
Besides spreading via email attachments, the worm also spreads via file-sharings, such as KaZaA and IRC. The worm will make attempts to disable anti-virus programs and personal firewall programs functions on infected computers.
Detail information on this worm is available at the following AV sites:
Symantec
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
F-Secure
http://www.f-secure.com/v-descs/swen.shtml
McAfee Security
http://us.mcafee.com/virusInfo/default.asp?id=description&virus\_k=100662
Trend Micro
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM\_SWEN.A&VSect=T
The worm infected email which poses as a legitimate email from Microsoft Windows Update would look like as below:
MyCERT would like to urge all Internet users to be aware of the new worm and would like to advise the followings:
1. Delete any emails received supposedly from Microsoft which contains patch.
2. Do not execute any unknown files/attachments, users must scan the attachment with an updated version of AV software prior to executing it.
3. Users are also urged to disable all file sharings.
4. Users must update their anti-virus softwares to the latest signature files.
5. System Administrators should apply AV filters at their email gateway to filter out worm attachments, ie .EXE file.
6. Users are encouraged to report to the ISPs, or CERT teams if their PC/s have been infected with the worm.
In order to differentiate between a genuine message from Microsoft and a false message, you may refer to the following Microsoft sites.
http://www.microsoft.com/security/antivirus/authenticate\_mail.asp
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/news/patch\_hoax.asp
MyCERT would appreciate if user could disseminate and take action on this information seriously to prevent any unwanted damages caused by this worm to their organizations.