I-Worm.Sobig.c

Sobig.c is a worm virus spreading via the Internet as an infected e-mail file attachment. The worm also spreads via network resources.

The worm itself is a Windows PE EXE file, written in Microsoft Visual C++, and compressed by the UPX compression utility. The file's size is about 60K or higher when compressed with UPX, while the decompressed size is about 120K.

The worm is activated from infected email only if a user clicks on the attached file.

When run the worm installs itself to the system and runs a spreading routine.

Installing

While installing the worm copies itself to the Windows directory under the name mscvb32.exe and registers itself in the system registry auto-run keys:

                              HKCU\Software\Microsoft\Windows\CurrentVersion\Run
                                System MScvb = %WindowsDir%\mscvb32.exe

                              HKLM\Software\Microsoft\Windows\CurrentVersion\Run
                                System MScvb = %WindowsDir%\mscvb32.exe

Spreading: email

To send out infected messages the worm uses a direct connection to the default SMTP server.

To get victim emails the worm looks for .TXT, .EML, .HTML, .HTM, .DBX, .WAB files in all directrories on all available local drives. It gets email-like strings from the files that are found.

Message attributes include:

The "From" field has a fake email address that is either found on the particular infected machine or

                            "bill@microsoft.com"

Subject:

                             Re: Screensaver
                             Re: Movie
                             Re: Submited (004756-3463)
                             Re: 45443-343556B37DB6480EC9657E
                             Re: Approved
                             Approved78A85131
                             Re: Your application
                             Re: Application

Message Body:

                             Please see the attached file.

Attached file name:

                             screensaver.scr
                             movie.pif
                             submited.pif
                             45443.pif
                             documents.pif
                             approved.pif
                             application.pif
                             document.pif

The messages are also sent with attached files that have the file name's last letter cut:
 

                             screensaver.sc
                             movie.pi
                             submited.pi
                             45443.pi
                             documents.pi
                             approved.pi
                             application.pi
                             document.pi
 

The Sobig.c worm also creates the file msddr.dat in the Windows directory and writes to this file the email addresses that were found on the infected machine.

Spreading via networks

The worm accounts for all accessible network resources (other computers in a network) and copies itself into their auto-start directoris (if there are such subdirectories)

                             Windows\All Users\Start Menu\Programs\StartUp\
                             Documents and Settings\All Users\Start Menu\Programs\Startup\

Updating

The worm downloads files from four Web locations (these locations are "hardcoded" into the worm body) and executes them. As a result the worm is able to "upgrade" itself with new versions, and/or install other applications such as trojan programs and spyware.

Other

All worm routines (except the "Updating" feature) are active until June 8, 2003 only. This means the worm does not run its spreading routines (both email and network) after June 8, 2003.

IMPORTANT NOTICE: ALL those who are receiving this advise and in the "name" field they find 'FAILED' and a 6 or 8 digit figure after it,  should be advised that at least once, emails to that address  have been received back by us.  As the list of subscribers now exceeds 100,000, and since this  is a  free service, we kindly urge you to become a  registered  subscriber to this service and ensure delivery by subscribing  under  a  reliable email address. WE REGRET THAT AS  AFTER THIS ISSUE, ALL ADDRESSES  THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.

DISCLAIMER:

The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST

PLEASE ALSO NOTE THE FOLLOWING:

1) You are currently SUBSCRIBED to our mailing list

2) If you are receiving more than one copy of this warning please click here

3) If you DO NOT wish to receive anymore of these alerts, please click here

4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be sent to the Webmaster     by themselves so that a record of all requests can be kept in case somebody cries "SPAM" ! Simply click here
    and send the email as it appears.

5) THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY

6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL NEVER BE SOLD, EXCHANGED OR IN     ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
  ******

Fabian Brincat
Webmaster
Fabian Enterprises Ltd.

SEE PREVIOUS VIRUS ALERT

RETURN TO VIRUS ALERT MAIN INDEX

18-20, MSIDA ROAD,
GZIRA. GZR 1401.
MALTA.
TELEPHONE: (++356) 21 31 32 83 or 21 32 08 45
FAX: (++356) 21 33 80 87
 
E-MAIL CONTACT
sales@fabian.com.mt

©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.

All Trade names and Trade marks are hereby acknowledged as being the property of the Registered Owners

ALPHABETICAL LIST OF PRODUCTS: click on section you wish to view:

A|B|C|D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z

EXIT TO QUICK INDEX

260603/090904