Received wicked attachments? Beware!

August 2003


Sobig.F is a worm that spreads very fast via email and network shares. BitDefender has

Sobig.F (Win32.Sobig.F) is a worm that spreads very fast via email and network shares. BitDefender has already made available a free antidote, to stop the outbreak. The free removal tool is to be found on the BitDefender website
"We keep receiving HUNDREDS of infected e-mails at every send-receive", said Sorin Dudea, Head of Virus Research at BitDefender. "The virus seems to have been released somewhere in Asia, but now spreads on all continents at an amazing speed. It has to be related with its ability to use EVERY e-mail address in the computer - found in files like html, wab, mht, hlp, txt, eml, htm, dbx (all enclosing e-mail addresses). I have never seen such fast spreading in such short time: I have colleagues in the commercial team that have already received thousands of infected e-mails and they just keep receiving them", Sorin concluded.

The worm fakes the sender's e-mail address, often succeeding in deceiving inexperienced computer users and making it very hard to recognize the infected systems.
The virus uses subject lines like:
"Re: That movie"
"Re: Wicked screensaver"
"Re: Your application"
"Re: Approved"
"Re: Re: My details"
"Re: Details"
"Your details"
"Thank you! "

In the virus body, the author cleverly refrained himself from writing anything else, but
"Please see the attached file for details." or
"See the attached file for details".

The names of the files attached are chosen from a rather short list:
movie0045.pif
wicked_scr.scr
application.pif
document_9446.pif
details.pif
your_details.pif
thank_you.pif
document_all.pif
your_document.pif

Sobig.F also attempts to spread by copying itself to the network shares and it stops spreading after September 10 2003.

Today, two more viruses have erupted, creating a wave of panic among the users worldwide. BitDefender specialists urge all computer users to remain calm and to use and update their antivirus tools in order to avoid lose of data.

For more details, please contact us or see the technical description .

All BitDefender users are protected against the new threats since this morning (August 19, 2003).
For a permanent protection, BitDefender Antivirus commercial solutions are available for sale on the Internet or at local distributors and start from USD 29.95.


Share This ON: