Virus Alert: SoBig

[The Fishing Geek]

A new computer virus is flooding the Internet attacking machines that use Microsoft Outlook (like all of ours). eWeek magazine reports the following about this virus:

"Not much is known about the virus at this point, but it seems to be a mass-mailing worm that behaves much like the Lirva worm that began spreading last week. It arrives via e-mail, always in a message from the address big@boss.com and carrying one of four subject lines:

"Re: Movies
Re: Document
Re: here is that sample
Re: Sample

"The message also includes an attachment, whose filename could include Document003.pif, Sample.pif, Movie_0074.mpeg.pif and Untitled1.pif, according to MessageLabs analysis of the virus.

"Sobig uses its own SMTP (simple mail transfer protocol) engine to mail copies of itself to addresses that it finds on the infected machine's hard drive and e-mail address book. The virus also copies itself to two shared folders on shared network drives.

"Sobig then downloads from a Geocities site a file that contains a link to another file located elsewhere on the Internet. The worm downloads this second file and executes it on the infected machine. It's unclear what the file does.

"Anti-virus vendor Trend Micro Inc. said the worm may also send an e-mail to its creator, notifying him of which machines are infected."

If you receive any message from big@boss.com DELETE THEM IMMEDIATELY. DO NOT open these messages.

[CATCH AND EAT]

Yikes! Thank FG.

[Joe Schwab]

Thanks for the heads up Geek, As I understand you, the attachment has to be opened right? I have made it a policy to not open any attachments from anyone even though I have a constantl;y updating Norton system. So far no problems. I don't send attachments and I don't look at them.

[OneLastCast]

I received that twice last week. Both times the antivirus software caught it but it was still trying to send an email out. A fellow at work spent 6 hours cleaning up his computer from this thing.


OneLastCast

[The Fishing Geek]

Outlook and Outlook Express (also known as Lookout and Lookout Distress) have a feature which opens a preview window below the mail list which many people like to utilize. If you have the preview pane open then that can also launch the attachment. And if that's the only email that arrives in your inbox it will naturally be the email that automagically previews, which then would infect your system.

A frequently-updated antivirus program is the only thing that will protect you from viruses, and even then it's not 100% safe. I've just trained all of the people who email me to let me know ahead of time that they are going to email an attachment to me, or at the VERY least put something in the body of the email which shows that it is an intended email and not a virus.

It's sad that this is the way that I have to do things, but the alternatives can cost money.