F-Secure has created a special removal tool to remove the active
Sobig.C infection and all its traces. For more details, see at
the bottom of the description.
UPDATE (2003-06-01 10:30 GMT)
A new variant of the Sobig worm (Sobig.C) is spreading in the
wild. It arrives in PIF and SCR attachments in emails coming from
several faked addresses, for example from "bill@microsoft.com".
The Sobig.C worm was found in the wild late in the evening on
31st of May, 2003. On June 1st 2003 the worm increased its
spreading in several countries. Detection of the worm has been
published.
Technical details
The worm copies itself to the Windows folder as
mscvb32.exe
and adds the following registry key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
System MScvb = %WindowsDir%\mscvb32.exe
so that it's launched every time Windows starts.
Worm's life span
The worm will stop spreading if the computer's date is set to 8th of June of
2003 or later.
Mass mailing
This variant of the worm no longer uses a fixed address as sender. It also uses
addresses collected from the user's machine. So messages might appear to come
from know people completely unaware and not necessary infected by the worm.
Receiving the worm from a given address doesn't imply that the sender
corresponding to the address is infected.
As well, error messages might be received, as if the user had sent an infected
message from his/her computer. This is a result of the worm sending itself from
faked addresses to erroneous ones. The user whose address has been faked will
received this errors. Those messages can be safely ignored.
Message subjects are chosen from:
Re: Screensaver
Re: Movie
Re: Submited (004756-3463)
Re: 45443-343556
Re: Approved
Approved
Re: Your application
Re: Application
Attachment names are chosen from:
screensaver.scr
movie.pif
submited.pif
45443.pif
documents.pif
approved.pif
application.pif
document.pif
The body of the messages is always fixed:
Please see the attached file.
Gathers e-mail addresses from files with extensions:
'.wab'
'.dbx'
'.htm'
'.html'
'.eml'
'.txt'
Local Area Network propagation.
It also tries to infect computers with open shares, copying itself to the
following locations:
Windows\All Users\Start Menu\Programs\Startup\
