W32/Sobig.A Worm

 Information about the W32/Sobig.A worm:

W32/Sobig.A is an email worm. This worm will infect Windows systems. The worm spreads through email and shared network drives. 

The worm arrives with any one of the following subject;

Re: Document
Re: Movies
Re: Here is that sample
Re: Sample

From address of the infected mail will be big@boss.com. The infected mail carries any one of the following attachment;

Document003.pif
Movie_0074.mpeg.pif
Untitled1.pif
Sample.pif

Upon execution of the attachment, the worm copies itself as WINMGM32.EXE to Windows folder. It modifies the registry at the following locations to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The worm tries to collect all the email addresses found under .HTML, .HTM, .DBX, .TXT, .WAB and .EML extension files and writes to a file SNTMLS.DAT under Windows folder. After this the worm attempts to mail itself to these email addresses. In the network shared drive, it tries to copy itself to Windows startup folder of the target system to load itself during the next startup.

This worm first appeared on 9th January 2003.

 Other names of W32/Sobig.A worm:

This worm is also known as WORM_SOBIG.A, W32/Sobig@MM , W32/Sobig.A@mm