Sobig.C Worm is Spreading at an Alarming Rate

Helsinki, Finland - June 2, 2003

F-Secure is warning the computer users of a new massmailer Sobig.C, which was first found in the wild late in the evening on 31st of May. On June 1st the worm increased its spreading and has now been reported already in 84 countries.

“We can see a very interesting pattern here. Sobig.B, that spread alarmingly only two weeks ago, was programmed to die on May 31st – the same day Sobig.C was found”, says Mikael Albrecht, the Product Manager of F-Secure. “Sobig.C is programmed to die on June 8th so time will tell if we can expect Sobig.D to make its first appearance after that”, he suspects.

Just like Sobig.B, Sobig.C also spreads via e-mail attachments and Windows network shares. The attachements are always PIF or SCR executables and the message reads “Please see the attached file” However, unlike its forerunner, Sobig.C does not send the emails from a fixed address, but uses random addresses it collects from the user’s machine.

“The messages sent by the worm might appear to come from known people completely unaware and not necessarily infected by the worm”, explains Mikael Albrecht. “This means, that receiving the worm from a given address doesn’t imply that the sender corresponding to the address is infected”, he continues.

The worm also spreads by collecting e-mail addresses from various files on the infected computer and sends the infected e-mails with variable subjects, content, filenames and file sizes.

In addition to the e-mail spreading, Sobig.C will search for Windows machines within the infected Local Area Network and will try to copy itself to their Startup folder. This will fail unless users are sharing their Windows directories with write access – a thing that should never be done.

After spreading, Sobig.C will attempt to download components from several URLs located at Geocities.com. F-Secure contacted Geocities during the weekend and the pages used by the worm have now been closed down.

More information on the Sobig.C virus is available from the “Global Sobig Virus Information Center”, available online at http://www.f-secure.com/sobig/

The page includes technical descriptions, images and real-time statistics on the worm. F-Secure has also developed a free tool, which cleans Sobig.C from infected machines. The tool is available in the Information Center.

F-Secure Anti-Virus can detect, stop and disinfect the Sobig.C worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com

About F-Secure

F-Secure Corporation is the leading provider of centrally managed security solutions for the mobile enterprise. The company's award-winning products include antivirus, file encryption and network security solutions for major platforms from desktops to servers and from laptops to handhelds. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since November 1999. The company is headquartered in Helsinki, Finland, with the North Ameri-can headquarters in San Jose, California, as well as offices in Germany, Sweden, Japan and the United Kingdom and regional offices in the USA. F-Secure is supported by a network of value added resellers and distributors in over 90 countries around the globe. Through licens-ing and distribution agreements, the company’s security applications are available for the products of the leading handheld equipment manufacturers, such as Nokia and HP.

For more information, please contact:

Mikael Albrecht, Product Manager
F-Secure Corporation
Tel. +358 9 2520 5640
Email: Mikael.Albrecht@F-Secure.com

Media contact in the USA:

F-Secure Inc.
Heather Deem,
675 N. First Street, 5th Floor
San Jose, CA 95112
Tel +1 408 350 2178
Fax +1 408 938 6701
Email Heather.Deem@F-Secure.com