The Swen-A is a mass-mailing worm. It sends out fake messages to users, among them a message pretending to be a critical patch or update, a message pretending to be a patch from Microsoft and a message falsely reporting that a message could not be delivered. The Swen-A will prevent certain applications from being executed while it resides in memory. It will display a box with the text "Try to pull my legs?" when the user tries to execute these programs. The Swen-A is executed each time the user executes a program and each time the user reboots their computer.
The email body of this worm will usually contain one of the following messages:
I'm afraid, I'm sorry, Hi, the message returned below could not be delivered, Message from, This is the qmail program, Message follows: I wasn't able to deliver your message to the following addresses, Undeliverable, Undelivered, Mail, Message
The email attachment is generated as a random name.