Ask The Computer Geek
By: Jeff Johnston (jeff@domynoes.net)
Q: I have received an email from Microsoft stating that there is a new security update available that fixes some security risks. The email contained the patch for me to install, should I do this right away as it advises? - John in London, Ontario
A: Definitely not. Delete this email immediately and delete any similar emails. This email is not just an annoying hoax it is a computer virus. The virus is known as W32.Swen.A@mm. Viruses of this sort rely on the receiver to trust an email that appears to come directly from Microsoft. The question you have to ask yourself is why would Microsoft be sending you an email. The answer is they wouldn't, Microsoft does not send out advisories of this sort, ever. They rely on you to check their page for any security patches, and even if they did send an email out to every Windows user they would not include the patch in the email, they would include a link to Microsoft's website where you could download the patch. Microsoft has an article on their site (http://www.microsoft.com/security/antivirus/authenticate_mail.asp) entitled "How to Tell If a Microsoft Security-Related Message Is Genuine" that will help you identify fake messages such as you described.
If you have been fooled by this email already don't panic there is hope for you yet. If you have run this "patch" your computer is infected with a virus and you will need to clean your system of the virus. If you have a virus scanner your scanner should clean the system for you if you run a scan, assuming you have kept it up to date, if not you will have to update your virus scanner first. If you do not have a virus scanner, get one, but in the mean time Symantec has a handy cleaning tool specifically made for this virus. You can check out their site for details, http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html. Once you have followed the removal instructions you should reboot your system and repeat the instructions just to be sure that the virus is indeed gone, sometimes viruses can reinstall themselves on boot up. If you get a message saying no viruses found after booting up you should be ok, if it still finds the virus go through the instructions and reboot the computer again. For WindowsXP users you may want to system restore function to prevent XP from reloading the virus itself.
As a general rule you should never trust an email attachment unless you knew the person who sent you the email, and you knew that the person was sending the attachment. Any unsolicited attachments should be deleted without opening them. Attachments are one of the most common means of virus infections in computers.
Suggested Links:
- http://securityresponse.symantec.com/avcenter/vinfodb.html : Symantec's virus database a great place to look up viruses.
If you have a question for the Computer Geek email Jeff at: jeff@domynoes.net
Jeff Johnston is a Computer Technician for The London Transit Commission in London Ontario. He is also a writer and editor in chief of The Business of Writing