Sobig.C arrives via email or shared network file. The email appears to be from someone you might know, but this address is spoofed. The email's subject line may include one of the following: Approved
Re: 45443-343556
Re: Application
Re: Approved
Re: Movie
Re: Screensaver
Re: Submited (004756-3463)
Re: Your application The e-mail's attachment may have one of the following filenames: 45443.pif
application.pif
approved.pif
document.pif
documents.pif
movie.pif
screensaver.scr
submited.pif In some cases, the extension might read .pi, not .pif. This worm does not automatically execute -- you must open the attached file to become infected with Sobig.C. Upon execution, the worm adds the following files to the default Windows directory: "mscvb32.exe" (approximately 50K; a copy of itself)
"msddr.dat" (configuration file) Upon execution, the worm attempts to make the following changes to the system Registry so that the worm will load each time you start up your computer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "System MScvb" = [Windows directory]\mscvb32.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "System MScvb" = [Windows directory]\mscvb32.exe Sobig.C also spreads via shared network files. It attempts to copy itself to the following directories on remote systems: \Documents and Settings\All Users\Start Menu\Programs\Startup\
\Windows\All Users\Start Menu\Programs\Startup\ Prevention In general, do not open attached files in e-mail without first saving them to hard disk and scanning them with updated antivirus software. Contact your antivirus vendor to obtain the most current antivirus signature files that include Sobig.C. Sobig.C is set to expire on its own on June 8, 2003. Removal Several antivirus software companies have updated their signature files to include this worm. This will stop the infection upon contact and in some cases will remove an active infection from your system. For more information, see Central Command, F-Secure, McAfee, Messagelabs, Norman, Panda, Sophos, Symantec and Trend Micro.
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section.
Let the editors know what you think in the Mailroom.
