How to Stop Sobig.F
By Tim Moynihan - Posted Aug 20, 2003
The Sobig.F worm is a variant of June's Sobig.A worm. The worm is also known as I-Worm.Sobig.f, W32/Sobig.F-mm, W32/Sobig.f@MM, and WORM_SOBIG.F.
Sobig.F only affects Windows systems, and it has been spreading rapidly since earlier this week. Machines running Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, and Windows XP are all susceptible to the worm.
Remove Sobig.F from your system
Symantec has released a free Sobig.F removal tool for infected systems. If you think your Windows PC has been infected, download and run Symantec's removal tool.
On an infected system, the worm scans various documents for email addresses. The worm then distributes itself to other inboxes using a built-in SMTP engine. When it distributes itself, it "spoofs" in the "From:" field an email address it finds on the infected machine instead of using the infected user's address. Because the address doesn't match that of the infected machine, it's difficult to trace the string of infected computers.
The worm also has a built-in shutoff date. It'll stop working on September 10, 2003.
Learn more about how the Sobig.F worm operates in these articles and security alerts.
How to protect yourself
What about Blaster?
If you're looking for information about the still-dangerous Blaster worm, read these articles.
Sobig.F only affects Windows systems, and it has been spreading rapidly since earlier this week. Machines running Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, and Windows XP are all susceptible to the worm.
Remove Sobig.F from your system
Symantec has released a free Sobig.F removal tool for infected systems. If you think your Windows PC has been infected, download and run Symantec's removal tool.
On an infected system, the worm scans various documents for email addresses. The worm then distributes itself to other inboxes using a built-in SMTP engine. When it distributes itself, it "spoofs" in the "From:" field an email address it finds on the infected machine instead of using the infected user's address. Because the address doesn't match that of the infected machine, it's difficult to trace the string of infected computers.
The worm also has a built-in shutoff date. It'll stop working on September 10, 2003.
Learn more about how the Sobig.F worm operates in these articles and security alerts.
- Sophos' Sobig.F Virus Analysis
- Sobig.F Joins Blaster Attack on Windows (The Register)
- Auto-Responders Magnify Sobig Problem (The Register)
- Sobig.F Is 'Worst Variant Yet' (ZDNet)
How to protect yourself
- Delete any email with the following subject lines, even if they're sent from a familiar name.
- Thank you!
- Your details
- Re: Details
- Re: Approved
- Re: Re: My details
- Re: Thank you!
- Re: That movie
- Re: Wicked screensaver
- Re: Your application
- Don't open any email attachments, especially those with the following names.
- your_document.pif
- document_all.pif
- thank_you.pif
- your_details.pif
- details.pif
- document_9446.pif
- application.pif
- wicked_scr.scr
- movie0045.pif
What about Blaster?
If you're looking for information about the still-dangerous Blaster worm, read these articles.
- Blast the Blaster Worm
- Beating Blaster Now, some great advice from Tech Live
Comments
Add a Comment