NOTE: Due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from Category 3 to Category 2 as of June 13, 2003.
The W32.Sobig.A@mm worm sends itself to all the addresses it finds in the .txt, .eml, .html, .htm, .dbx, and .wab files. The email message has the following characteristics:
From: big@boss.com
Subject: The subject will be one of these:
- Re: Movies
- Re: Sample
- Re: Document
- Re: Here is that sample
Attachment: The attachment will be one of these:
- Movie_0074.mpeg.pif
- Document003.pif
- Untitled1.pif
- Sample.pif
Before W32.Sobig.A@mm sends the messages, it sends a message to an address at pagers.icq.com.
The worm also attempts to copy itself to the following folders on all the open network shares:
- \Windows\All Users\Start Menu\Programs\StartUp
- Documents and Settings\All Users\Start Menu\Programs\Startup
Note: Symantec Security Response has received reports of W32.Sobig.A@mm downloading and installing the Backdoor Trojan,
Backdoor.Lala.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
