Malware type: Worm

Aliases: W32.Sobig.C@mm, W32/Sobig.c@MM, I-Worm.Sobig.c

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, NT, 2000, ME, XP

Encrypted: Yes

Description: 

This nondestructive worm propagates via email using its own SMTP (Simple Mail Transfer Protocol) engine and through network shares. It obtains email addresses for its recipients and to use under the From field from files with the following extensions:

• WAB
• DBX
• HTM
• HTML
• EML
• TXT

The details of the email that it sends out are as follows:

From: bill@microsoft.com <or any of the identified recipient addresses>
Subject: (any of the following)
• Re: Screensaver
• Re: Movie
• Re: Submited (004756-3463)
• Re: 45443-343556
• Re: Approved
• Approved
• Re: Your application
• Re: Application

Message Body: Please see the attached file.

Attachment: (any of the following)
• screensaver.scr
• movie.pif
• submited.pif
• 45443.pif
• documents.pif
• approved.pif
• application.pif
• document.pif

This worm does not propagate if the system date is June 8, 2003 or later. It runs on Windows 95, 98, ME, NT, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: May. 31, 2003 6:17:46 PM GMT -0800
Description updated: Jun. 2, 2003 3:44:12 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.