The Big Worm Strikes Again, This Time It Is [email protected]!

Beware of the [email protected] worm that was upgraded from Category 3 to 4 as of 8-21-03 on Symantec Security Response.

This question was answered on August 21, 2003. Much of the information contained herein may have changed since posting.

---

This new version of Sobig is very sneaky and makes you think you are infected when you are not Symantec Security Response has upgraded [email protected] from a Category 3 to a 4 due to an increase of infection This worm although a variant is a completely different worm then [email protected], [email protected], or [email protected]

[email protected] is a mass-mailing, network-aware worm That sends itself to all email addresses that it finds in the files with the following extensions:

- .wab

- .dbx

- .htm

- .html

- .eml

- .txt

- .hlp

- .mht

This is considered to be a very wild and highly distributed worm The email comes in disguise as a spoofed address or uses the address [email protected]

The email message has the following characteristics:

Subject: It is one of the following:

- Re: Details

- Re: Approved

- Re: Thank you!

- Re: Re: My Details

- Re: That movie

- Re: Wicked screensaver

- Re: Your application

- Thank you!

- Your details

Attachment: It is one of the following:

- your_document.pif

- thank_you.pif

- your_details.pif

- details.pif

- document_all.pif

- document_9446.pif

- wicked_scr.scr

- movie0045.pif

Most Windows operating systems are affected (Windows 2000, 95, 98, Me, NT, XP)

NOTE: The worm de-activates on Sepptember 10, 2003, and therefore, the last day on which the worm will spread is September 10, 2003

Symantec advises all possible victims to download latest virus definitions immediately and deploy

Get complete instruction on protection and removal from Symantec at:

<a href="http://sarc.com/avcenter/venc/data/[email protected]"> http://sarc.com/avcenter/venc/data/[email protected]mm.html</a>

About the author

Posted by Michal of Data Doctors on August 21, 2003

Need Help with this Issue?

We help people with technology! It's what we do.
Contact or Schedule an Appointment with a location for help!