W32/Sobig.F Worm

 Information about the W32/Sobig.F worm:

W32/Sobig.F is an email worm. It is a variant of W32/Sobig.A. This worm will infect Windows systems. The worm spreads through email and shared drives on network.

The worm arrives as an email having the 'from address' of any random email address picked from the infected system. The subject of the infected mail will be any one of the following;

Re: Details
Re: Approved
Re: Thank you!
Re: That movie
Re: Re: My details
Re: Your application
Re: Wicked screensaver

The content of the mail will be;

Please see the attached file for details.

The infected email has an attachment with any one of the following names;

application.pif
details.pif
document_9446.pif
document_all.pif
movie0045.pif
thank_you.pif
wicked_scr.scr
your_details.pif
your_document.pif

When the infected attachment is executed, the worm drops a copy itself as winppr32.exe in the Windows folder. The worm modifies registry at the following location to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The worm collects available email addresses from the infected system and tries to mail itself to these addresses using its own SMTP engine. The worm also tries to copy itself to available Windows shares on the network.

The worm contains a list of IP addresses of the remote NTP servers. It continuously sends NTP packets to these servers, which creates a unexpected NTP traffic.

This worm first appeared on 19th August 2003.

 Other names of W32/Sobig.F worm:

This worm is also known as W32/Sobig-F, I-Worm.Sobig.f, W32/Sobig.F-mm