W32.Sobig.D@mm

W32.Sobig.D@mm is a mass-mailing worm that sends itself to all the email addresses it finds in the files with the following extensions:

• .wab
• .dbx
• .htm
• .html
• .eml
• .txt

The email falsely purports that admin@support.com sent it.

Email routine details
The email message has the following characteristics:

From: admin@support.com (NOTE: W32.Sobig.D@mm spoofs this field. It could be any address.)

Subject: The subject line will be one of the following:

• Re: Documents
• Re: App. 00347545-002
• Re: Movies
• Application Ref: 456003
• Re: Your Application (Ref: 003844)
• Re: Screensaver
• Re: Accepted
• Your Application

Message Body: See the attached file for details

Attachment: The attachment name will be one of the following:

• Document.pif
• app003475.pif
• movies.pif
• ref_456.pif
• Application844.pif
• Screensaver.scr
• Accepted.pif
• Applications.pif
• Application.pif

NOTE: The worm de-activates on July 2, 2003, and therefore, the last day on which the worm spreads is July 1, 2003.

Protection

• Initial Rapid Release version June 18, 2003
• Latest Rapid Release version June 18, 2003
• Initial Daily Certified version June 18, 2003
• Latest Daily Certified version June 18, 2003
• Initial Weekly Certified release date June 18, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: High