What's 'Sobig' about this worm on the wild?

Question

Symantec security response has recently raised the risk level of a new worm by the name of W32.Sobig.C@mm.

Answer

This question was answered on June 4, 2003. Much of the information contained herein may have changed since posting.

Symantec Security Response has upgraded W32.Sobig.C@mm from a Category 2 to a Category 3 as of June 1, 2003. This is a completely different worm then W32.Sobig.B@mm, which was found last week.

W32.Sobig.C@mm is a mass-mailing worm considered to be a big threat. The worm is also network-aware and can copy itself to as many other computers it can. The email comes in disguise as something from Microsoft and has an attachment.

The email message has the following characteristics:

Subject: It is one of the following:

-Re: Movie

-Re: Submited (004756-3463)

-Re: 45443-343556

-Re: Approved

-Approved

-Re: Your application

-Re: Application

Message: All information is in the attached file.

Attachment: It is one of the following:

-screensaver.scr

-movie.pif

-submitted.pif

-45443.pif

-documents.pif

-approved.pif

-application.pif

-document.pif

Most Windows operating systems are affected.

NOTE: The worm de-activates on June 8, 2003, and therefore, the last day on which the worm will spread is June 7, 2003.

Symantec advises all possible victims to download latest virus definitions immediately and deploy.

Get complete instruction on protection and removal from Symantec at:

<a href="http://sarc.com/avcenter/venc/data/w32.sobig.c@mm.html"> http://sarc.com/avcenter/venc/data/w32.sobig.b@mm.html</a>

Author

Posted by Michal of Data Doctors on June 4, 2003