Feeds

VX writers release sequel to infamous Sobig worm

Spoof from bill @ microsoft spreading rapidly

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Anti-virus firms are warning of the outbreak of yet another mass-mailing virus.

Sobig-C, which spreads by email or (less commonly) network shares, has been intercepted more than 15,000 times since its first appearance on Saturday by message filtering outfit MessageLabs. This virus has now reached 'high level' outbreak status, the company reports.

The emergence of Sobig-C comes days after its spammer-friendly predecessor, Sobig-B (AKA Palyh), reached its "expiry date". The worm was designed to spread only until 31 May.

Sobig-C can be easily recognised since although the name of the subject line or infectious attachment varies the body of the text is always "Please see the attached file".

Open the attachment and you machine becomes infected.

On infection, Sobig-C will search through files on the infected machine looking for email addresses. It sends a copy of itself to the addresses it finds using its own SMTP (Simple Mail Transfer Protocol) Engine with a spoofed email address in the "From" section so that is appears to come from either bill@microsoft.com or a genuine address filleted from a compromised PC.

Propagation of the worm also involves copying itself via network shares to standard Windows system folders.

As usual the worm has no effect on either Mac or Linux machines.

Write ups of the varmint by F-Secure and Symantec provide more detailed information. ®

Related Stories

Fizzer blasts Klez-H off top spot in viral charts
Why spammers lurve the 'Microsoft support' worm
Why did support @ microsoft send me a virus this morning?

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.