A potent new variety of the Sobig e-mail virus is spreading on the Internet, according to warnings from a number of leading antivirus companies.
The new virus, known as Sobig.C, was first detected on Saturday and is a variant of the original Sobig virus, which appeared in January 2003, according to a statement by Helsinki, Finland, security company F-Secure.
Like the original Sobig virus, Sobig.C is a mass-mailing worm that spreads copies of itself through e-mail messages with attached files that contain the virus code.
Sobig.C arrives in e-mail messages that use a variety of subject lines such as "Re: Screensaver," "Re: Movie" and "Re: Your Application." The names of the attachment containing the virus also vary and include "screensaver.scr," "approved.pif" and "movie.pif," F-Secure said.
Once opened, the attachment copies the virus to the Windows folder on the infected machine and alters the machine's Microsoft Windows registry to make sure that the virus is started along with the operating system.
The worm scans infected machines for e-mail addresses stored in a variety of files including the Windows address book and on saved Web pages. Sobig.C saves the addresses it finds in a separate file, then targets those addresses with e-mail messages containing the virus.
Like its predecessor, Sobig.C is also capable of detecting and copying itself to vulnerable shared folders on a local area network, according to an alert by antivirus company Sophos.
However, unlike the earlier worm, Sobig.C is capable of faking the sender's address as well, inserting e-mail addresses it finds on the host machine in the "From" line of messages containing the virus.
Messages containing the original Sobig worm used only one address on the From line: "big@boss.com," according to an alert posted on the Web site of McAfee Security, a business unit of Network Associates Inc.
That means messages containing the Sobig.C virus might appear to come from people the targeted user knows. In addition, receiving an infected e-mail from an address doesn't automatically mean that the sender's machine has been infected, F-Secure said.
Among the e-mail addresses spoofed by Sobig.C is "bill@microsoft.com," the address for Microsoft chairman and chief software architect Bill Gates.
The new virus is just the latest Sobig variant to spread, in part, by using the name of the Redmond, Wash., company.
In May, another variant, Sobig.B, also known as "Palyh," infected machines worldwide by disguising itself as a message from Microsoft's support organization.
Most antivirus companies provided updated virus definitions to detect Sobig.C on Sunday and encouraged their customers to update their antivirus software as soon as possible.
Instructions for detecting the new virus were also posted on leading antivirus sites, as were tools for removing Sobig.C from infected machines.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Download a free 30–day trial and experience how XenDesktop delivers a pristine, on–demand desktop experience to users on whatever device they choose, while cutting IT complexity and costs.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Sign up to receive Security Resource Alerts
With the continuous expansion of data capacity, completing the full cycle of a scheduled scan can be a very time consuming process. Find out how to efficiently secure EMC Celerra with centralized virus scanning, virus pattern file updates, event reporting and antivirus configuration.
Download now! »
A single virus-infected file in a storage system can be responsible for infecting large amounts of data. This white paper details the architecture and product features of Trend Micro's data storage security solution, ServerProtect, and discusses how it has been designed to protect EMC Celerra file servers with minimal overhead.
Download now! »
White paper
The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.
Download now! »
With the emergence of mixed threat attacks, a failure on a single server can quickly impact the entire network. Learn how a technology that is designed to remove and block infected files on application and file servers prevents the virus from reaching users and keeps your Windows network free from malware.
Download now! »
Recommend This
