W32.Sobig.F@mm

Due to the number of submissions received from customers, Symantec Security Response has upgraded this threat to a Category 3 from a Category 2 threat.

W32.Sobig.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in the files that have the following extensions:

• .dbx
• .eml
• .hlp
• .htm
• .html
• .mht
• .wab
• .txt

NOTES:
• The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server to contact.
• The choice of the internet.com domain appears to be arbitrary and does not have any connection to the actual domain or its parent company.

• Re: Details
• Re: Approved
• Re: Re: My details
• Re: Thank you!
• Re: That movie
• Re: Wicked screensaver
• Re: Your application
• Thank you!
• Your details

• See the attached file for details
• Please see the attached file for details.

• your_document.pif
• document_all.pif
• thank_you.pif
• your_details.pif
• details.pif
• document_9446.pif
• application.pif
• wicked_scr.scr
• movie0045.pif

Virus Definitions (Intelligent Updater) * August 19, 2003 Virus Definitions (LiveUpdate™) ** August 19, 2003 * Intelligent Updater definitions are released daily, but require manual download and installation. Click here to download manually. ** LiveUpdate virus definitions are usually released every Wednesday. Click here for instructions on using LiveUpdate.

Wild: Number of infections: More than 1000 Number of sites: More than 10 Geographical distribution: High Threat containment: Easy Removal: Moderate

Threat Metrics Wild: High Damage: Medium Distribution: Medium

Damage

• Payload:
  • Large scale e-mailing: Sends email to addresses collected from files with the following extensions: .wab, .dbx, .htm, .html, .eml, .txt.
  • Releases confidential info: May steal system information including passwords.

Distribution

• Subject of email: Varies
• Name of attachment: Varies with .pif or .scr file extension
• Size of attachment: About 72,000 bytes
• Ports: UDP 123, 995, 996, 997, 998, 999, 8998

When W32.Sobig.F@mm is executed, it performs the following actions:

1. Copies itself as %Windir%\winppr32.exe.
   
   NOTE: %Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.
   
   
2. Creates the file, %Windir%\winstt32.dat.
   
   
3. Adds the value:
   
   "TrayX"="%Windir%\winppr32.exe /sinc"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   so that the worm runs when you start Windows.
   
   
4. Adds the value:
   
   "TrayX"="%Windir%\winppr32.exe /sinc"
   
   to the registry key:
   
   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   
   so that the worm runs when you start Windows.
   
   
5. Enumerates any network shares to which the infected computer has write access. The worm uses standard Windows APIs to do this.
   
   NOTE: Due to a bug in the code, the worm does not copy over network shares.
   
   

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.