W32/Sobig.f@MM
Risk Assessment
- Home Users: High
- Corporate Users: Medium
Date Discovered: 8/18/2003
Origin: Unknown
Length: approx 72,568 Bytes
Type: Virus
SubType: Internet Worm
DAT Required: 4287
Virus Characteristics
This detection is for a new variant of W32/Sobig. In common with
previous variants, the worm is written in MSVC, and bears the following
characteristics:
propagates via email, constructing outgoing messages with its own
SMTP engine
propagates over network shares (not confirmed during testing)
Note: The worm carries garbage data appended to end of file, so
exact filesize and file checksum may vary.
Installation
The worm copies itself onto the victim machine as WINPPR32.EXE into %Windir%, for example:
C:\WINNT\WINPPR32.EXE
A configuration file is also dropped to %Windir%:
C:\WINNT\WINSTT32.DAT
The following Registry keys are added to hook system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"TrayX" = %Windir%\WINPPR32.EXE /sinc
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"TrayX" = %Windir%\WINPPR32.EXE /sinc
Mail Propagation
The worm mails itself to email addresses harvested from the victim machine, using its own SMTP engine to construct outgoing messages. Target email addresses are harvested from files with the following extensions:
DBX
HLP
MHT
WAB
EML
TXT
HTM
HTML
Outgoing messages are constructed as follows:
From: (may be admin@internet.com but could be virtually any address)
Subject:
Your details
Thank you!
Re: Thank you!
Re: Details
Re: Re: My details
Re: Approved
Re: Your application
Re: Wicked screensaver
Re: That movie
Attachment:
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif
Body:
See the attached file for details
Please see the attached file for details
The "From:" address may be spoofed with an address extracted from
the victim machine. Therefore the perceived sender is most likely not a
pointer to the infected user.
The attachment must be run manually to infect the local system. Additionally, messages sent by the virus contain the following fields
X-MailScanner: Found to be clean
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
The virus sends itself via its own SMTP engine, which requires an
ESMTP server to send itself successfully. The virus does an MX lookup
on the target domain (ie. when sending itself to user@domain.com, it sends
though the servers specified in the MX record for domain.com).
Contacting Remote NTP Servers
The worm contains a list of IP addresses for remote NTP servers, to which it sends NTP packets (destination port 123).
Self-Termination
In common with previous W32/Sobig variants, this variant contains
a date triggered self-termination routine. If the date is September 10th
2003 or later, the worm will no longer propagate.
Indications of Infection
Existence of the WINPPR32.EXE file in %WinDir%
Existence of the Registry hooks detailed above
Unexpected NTP traffic to remote servers
Method of Infection
This worm propagates via email (contains its own SMTP engine) and
attempts to spread via accessible network shares.
Removal Instructions
DAT Files
Detection is included in the 4287 DAT files . In addition to the
DAT version requirements for detection, the specified engine version (or
greater) must also be used. HOW TO use an EXTRA.DAT )..
EXTRA.DAT - should be extracted to the same directory where CLEAN.DAT,
NAMES.DAT, and SCAN.DAT are (typically C:\Program Files\Common Files\Network
Associates\VirusScan Engine\4.0.xx)
or
SUPER EXTRA.DAT - EXTRA.DAT self installer
Stand Alone Remover
Stinger has been updated to include detection/removal of this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
- Win9x/ME - Reboot the system into Safe Mode (hit the F8 key as
soon as the Starting Windows text is displayed, choose Safe Mode.
- WinNT/2K/XP - Terminate the process WINPPR32.EXE
Delete the following files from your WINDOWS directory (typically
c:\windows or c:\winnt)
WINPPR32.EXE
WINSTT32.DAT
Edit the registry
Delete the "TrayX" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
HKEY_CURRENT_USERS\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Additional Windows ME/XP removal considerations
Aliases
W32.Sobig.F@mm (NAV), WORM_SOBIG.F (Trend)
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5) THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
180803/090904
