I-Worm.Sobig
Sobig is a worm virus spreading via the Internet as an attachment to infected emails. It also downloads and sets up a Backdoor program.
The worm itself is a Windows PE EXE file about 64 KB in length (when compressed by TeLock), and written in Microsoft Visual C++.
Infected messages have the following characteristics:
From:
big@boss.com
Subject: (one of the following)
Re: Movies
Re: Sample
Re: Document
Re: Here is that sample
Attachment: (one of the following)
Movie_0074.mpeg.pif
Document003.pif
Untitled1.pif
Sample.pif
The worm activates from infected email only if a user clicks on the
attached file. Once run it installs itself to the system, runs a spreading
routine and payload.
Installing
While installing the worm copies itself to the Windows directory
under the name WINMGM32.EXE and registers this file in the system registry
auto-run key.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
"WindowsMGM" = \winmgm32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
"WindowsMGM" = \winmgm32.exe
Spreading via E-mail
To send infected messages the worm uses the SMTP server. The worm
looks for files with the following extensions - *.WAB, *.DBX, *.HTM, *.HTML,
*.EML, *.TXT scans them for email strings.
Spreading via Local Network
The worm enumerates network shares and tries to copy itself to one
of the following folders under the name WINMGM32.EXE.
Windows\All Users\Start Menu\Programs\StartUp\
Documents and Settings\All Users\Start Menu\Programs\Startup\
Set-up for the Backdoor Program
The worm downloads a text file that contains a link to the executable
PE file. The worm downloads it into the Windows directory under the DWN.DAT
name and runs it.
The worm contains the following text strings:
B.ROOT-SERVERS.NET A.ROOT-SERVERS.NET
a+ \ %s
big@boss.com
[A-Za-z0-9]+[A-Za-z0-9_.-]+@(([A-Za-z0-9\-])+[.])+[A-Za-z]+
*.* x:\ From
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5) THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
220103/100904
