W32.Sobig.A@mm

Risk Level 2: Low

Download Removal Tool|Printer Friendly Page|Rate this page

Discovered:: January 9, 2003
Updated:: February 13, 2007 11:42:13 AM
Also Known As:: W32/Sobig [McAfee], WORM_SOBIG.A [Trend], W32/Sobig-A [Sophos], I-Worm.Sobig [KAV], Win32.Sobig [CA]
Type:: Worm
Systems Affected:: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

NOTE: Due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from Category 3 to Category 2 as of June 13, 2003.

The W32.Sobig.A@mm worm sends itself to all the addresses it finds in the .txt, .eml, .html, .htm, .dbx, and .wab files. The email message has the following characteristics:
From: big@boss.com
Subject: The subject will be one of these:

Re: Movies
Re: Sample
Re: Document
Re: Here is that sample

Attachment: The attachment will be one of these:

Movie_0074.mpeg.pif
Document003.pif
Untitled1.pif
Sample.pif

Before W32.Sobig.A@mm sends the messages, it sends a message to an address at pagers.icq.com.

The worm also attempts to copy itself to the following folders on all the open network shares: