how to clean this trojan

Hi pgodbout,
"W32.Swen.A is a new and destructive computer worm that is disguised
as an official email from Microsoft. The file comes attached to a note
asking the recipient to install a "September 2003, Cumulative Patch"
to protect against vulnerabilities in Microsoft's Internet Explorer,
Outlook, and Outlook Express.
If installed, the Swen worm will attempt to disable antivirus software
and personal firewalls. It will also compromise email accounts by
sending additional copies of itself through infected computers.
To protect yourself, do not open email attachments unless you know the
sender and are expecting the attachment. Do not run updates and
security patches that you have received as email attachments.
Microsoft does not transmit security patches via email."
http://www.wright.edu/cats/info/w32swena.htm
   
For additional information on this virus, go to:
http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html
   
You'll find the removal tool and instructions for removal, here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.removal.tool.html
   
I hope this helps!
regards,
jackburton-ga
    
---------------------------
Search terms: [ w32swen ]
://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=w32swen

---

Request for Answer Clarification by pgodbout-ga on 12 Oct 2003 17:14 PDT

where do i find "fix swen.exe"

---

Clarification of Answer by jackburton-ga on 13 Oct 2003 02:25 PDT

You can download the FixSwen.exe file from: 
http://www.symantec.com/avcenter/FixSwen.exe

---

Request for Answer Clarification by pgodbout-ga on 13 Oct 2003 08:23 PDT

downloaded the file ran the removal tool three times and
the"wonderful" symantec tool tells me that W32Swen is not found in my
system however the large no. of bogus Microsoft patches received plus
the the also large no "returned emails " drom the postmaster
indicating that msgs i did not send are being returned because they
are infected with W32Swen  show quite otherwise. Further help plse

---

Clarification of Answer by jackburton-ga on 13 Oct 2003 11:33 PDT

You *may* have the "W32/Swen.A@mm" email worm (?). The emails
constructed by the worm are very realistic and fools users into
believing they are getting a real update (patch) from Microsoft.
You can download the fix here:
http://www.norman.com/public/swenfix.exe
You'll find instructions for removal here:
http://www.norman.com/virus_info/w32_swen_a_mm.shtml
     
I hope this takes care of the problem!