W32/Swen@MM

[SamDemon]

HELP!!!!!! I seem, sorry i know that i have a virus on the exchange server, but i dont know how to get rid of it. McAfree is picking it up.

The following comes up:-

The file Patch9439.exe is infected with the W32/Swen@MM. Detected with Scan Engine 4.1.60Dat Version 4.1.4294 running Group Shield 5.20.664.0 AVExch32.

Can someone please help!

It's just common sense, shame sense isn't common!

 

[smah]

Stinger has now been modified to clean this infection

http://vil.nai.com/vil/stinger/

 

[MattWray]

Symantec also has a tool and also manual instructions.

http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html

Instructions.

http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html

Removal tool.
Looks like something may be wrong with the site. Copy and paste the bold from http to html...

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

 

[MattWray]

Sorry posted the instructions twice. Here is the removal tool,

http://sarc.com/avcenter/venc/data/w32.swen.a@mm.removal.tool.html

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

 

[telthecelt]

Symantec removal tool and patch have done me no good with my infected XP. Cleverly the worm seems to have disabled all the short cuts on the desktop and even in the start menu. Browsing to the downloaded removal tool on CD or trying to open it from an email results in a 'can't find file' message as for the short cuts.
Switching of System Restore is not an option either for right clicking MyComputer also is disabled. I am stumped and hoping that Norton/Symantec can come up with something to get their software up and running again.Norton is still on the computer but no longer visible on the screen and 'can't find'is the only response when I browse for it in Programs.
I would like to tell Symantec this is still a problem but they are not get-at-able are they??

 

[manarth]

try booting to safe mode: hit the f8 keu whilst windows is beginning to boot.

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[MattWray]

telthecelt,

You can submit virus info and findings to symantec here,

http://service1.symantec.com/SUPPORT/nav.nsf/docid/2000031615501306?OpenDocument&src=sec_web_nam.

Have you tried the manual removal instructions,

http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html

I don't know why it doesn't like that link, paste from http to html...

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

 

[telthecelt]

Thanks Manarth..tried it to no avail.
Matt I followed your link and continued with a symantec search and found a page that seems to answer my problem.Its for an older 32. worm but seems to suit the symptoms to a tee. Apparently some worms add the name of their executable files to the Windows registry thatis used by Windows to open any applications. If Norton deletes or quarantines the 'Trojan executable file'
then the bits are left behind. Legitimate documents cant get opened because the registry key created by the Trojan cant find the nonexistant Trojan file. I'm not a techie person but I think I can just about grasp this. So I will follow the detailed instruction for dealing with editing the registry tomorrow when I feel better slept and mentally equipped to give it a try! Thanks for your help in guiding me this way. If anyone wants the link to the solution page (which seems incredibly long!)just leave a message here and I will be happy to paste it in.