W32.Sobig.A@mm

NOTE: Due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from Category 3 to Category 2 as of June 13, 2003.

The W32.Sobig.A@mm worm sends itself to all the addresses it finds in the .txt, .eml, .html, .htm, .dbx, and .wab files. The email message has the following characteristics:
From: big@boss.com
Subject: The subject will be one of these:

• Re: Movies
• Re: Sample
• Re: Document
• Re: Here is that sample

Attachment: The attachment will be one of these:

• Movie_0074.mpeg.pif
• Document003.pif
• Untitled1.pif
• Sample.pif

Before W32.Sobig.A@mm sends the messages, it sends a message to an address at pagers.icq.com.

The worm also attempts to copy itself to the following folders on all the open network shares:

• \Windows\All Users\Start Menu\Programs\StartUp
• Documents and Settings\All Users\Start Menu\Programs\Startup

Note: Symantec Security Response has received reports of W32.Sobig.A@mm downloading and installing the Backdoor Trojan, Backdoor.Lala.

Protection

• Initial Rapid Release version January 10, 2003
• Latest Rapid Release version February 8, 2010 revision 033
• Initial Daily Certified version January 10, 2003
• Latest Daily Certified version February 8, 2010 revision 038
• Initial Weekly Certified release date January 10, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: High
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High