DO NOT ANSWER OR OPEN ANY SUBJECT THAT HAS "MY DETAILS" THANK YOU" OR SOME OTHERS.

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: W32.Sobig.F@mm
File: C:\WINNT\winppr32.exe
Location: C:\WINNT
Computer: S0029433153
User: Owner
Action taken: Clean failed : Quarantine failed : Access denied
Date found: Tue Aug 19 20:34:54 2003

 

NEVER OPEN EMAIL ATTACHMENTS UNLESS YOU KNOW THE PERSON....AND KNOW THE PERSON GOOD!!!

Info about the Virus:

W32.Sobig.F@mm
Discovered on: August 19, 2003
Last Updated on: August 19, 2003 09:24:02 AM


Due to the number of submissions received from customers, Symantec Security Response has upgraded this threat to a Category 3 from a Category 2 threat.

W32.Sobig.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses that it finds in the files with the following extensions:


.dbx
.eml
.hlp
.htm
.html
.mht
.wab
.txt

The worm utilizes it's own SMTP engine to propagate and will attempt to create a copy of itself on accessible network shares.

Email Routine Details
The email message has the following characteristics:

From: Spoofed address (which means that the sender in the "From" field is most likely not the real sender).
The worm may use the address admin@internet.com as the sender.

Subject:
Re: Details
Re: Approved
Re: Re: My details
Re: Thank you!
Re: That movie
Re: Wicked screensaver
Re: Your application
Thank you!
Your details

Body:
See the attached file for details
Please see the attached file for details.

Attachment:
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif

NOTE: The worm deactivates on September 10, 2003. The last day on which the worm will spread is September 9, 2003.

Also Known As: Sobig.F [F-Secure], W32/Sobig.f@MM [McAfee], WORM SOBIG.F [Trend]

Type: Worm
Infection Length: about 72,000 bytes



Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: Linux, Macintosh, OS/2, UNIX, Windows 3.x

Number of infections: 0 - 49
Number of sites: 3 - 9
Geographical distribution: Low
Threat containment: Easy
Removal: Easy

When W32.Sobig.F@mm is executed, it performs the following actions:


Copies itself as %Windir%\winppr32.exe.

NOTE: %Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.


Creates the file, %Windir%\winsst32.dat.


Adds the value:

"TrayX"="%Windir%\winppr32.exe /sinc"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

so the worm runs when you start Windows.

Attempts to copy itself to any network shares it has write access to. The worm will utilize standard Windows API's to do this.

Sobig.F can download arbitrary files to an infected computer and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers.

This functionality may also be used as a worm self-update feature. Under the correct conditions, Sobig.F attempts to contact one of the list of master servers, which the author of the worm controls. Then, the worm retrieves a URL that it uses to determine where to get the Trojan file, downloads the Trojan file to the local computer, and then executes it.

In Sobig.F, the conditions for this download attempt are:
According to UTC time, the day of the week must be Monday or Friday.
According to UTC time, the time of day must be between 7:00 P.M. and 11:59:59 P.M.

Sobig.F obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port).

The worm starts the download attempt by sending a probe to port 8998/udp of the master server. Then, the server replies with a URL, where the worm can download the file to execute.

Sobig.F also opens the following ports:
995/udp
996/udp
997/udp
998/udp
999/udp

and it listens for any incoming UDP datagrams on these ports. Incoming datagrams are parsed, and upon receiving a datagram with the proper signature, the master server list of the worm may be updated.

Network administrators should do the following:
Block inbound traffic on ports 99x/udp.
Block outbound traffic on port 8998/udp.
Monitor NTP requests (port 123/udp), as these could be coming from infected computers. (The frequency of such checks for an infected computer should be once per hour.)

LINK TO RUN THE FIX!!! CLICK HERE.............

 

Jimmy you ********, you sent one to me! Lol, Im just playin, but I did get the e-mail at least 5 times. Luckly, my computer warned me before hand!

 

Well the good news is that the virus expires on September 10th .

I wonder where this damn virus originated from .?.

 

I have looked for some of these files on my computer and nothing comes up. So I am confused as how this virus spread