<br><font size=2 face="Arial">I've received 100 of these from histonet with the subject line just as you describe! Thanks for the information.</font>
<br>
<br><font size=2 face="Arial">Jacqueline M. O'Connor HT(ASCP)<br>
Abbott Laboratories<br>
Global Pharmaceutical Research and Development<br>
Discovery Chemotheraputics<br>
847.938.4919<br>
Fax 847.938.3266</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>"Marshall Terry Dr, Consultant Histopathologist" <Terry.Marshall@rothgen.nhs.uk></b></font>
<br><font size=1 face="sans-serif">Sent by: histonet-admin@lists.utsouthwestern.edu</font>
<p><font size=1 face="sans-serif">08/20/2003 09:58 AM</font>
<br>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To: "Adams, Sharon K." <SADAMS@HCMHCARES.ORG>, "HistoNet Server" <histonet@pathology.swmed.edu></font>
<br><font size=1 face="sans-serif"> cc: </font>
<br><font size=1 face="sans-serif"> Subject: [Histonet] New virus - appears to be "sobig"</font></table>
<br>
<br>
<br><font size=2 face="Courier New">Virus Profile <br>
<br>
Virus Information <br>
Name: W32/Sobig.f@MM <br>
Risk Assessment <br>
- Home Users: High <br>
- Corporate Users: Medium <br>
Date Discovered: 8/18/2003 <br>
Date Added: 8/18/2003 <br>
Origin: Unknown <br>
Length: approx 72,568 Bytes <br>
Type: Virus <br>
SubType: Internet Worm <br>
DAT Required: 4287 <br>
<br>
Quick Links <br>
Virus Characteristics <br>
Indications of Infection <br>
Method of Infection <br>
Removal Instructions <br>
Aliases <br>
<br>
<br>
Buy or Update <br>
New Users Get Protected Now:<br>
Buy VirusScan Online <br>
<br>
Update VirusScan Online <br>
<br>
<br>
<br>
Virus Characteristics <br>
<br>
This detection is for a new variant of W32/Sobig. In common with previous variants, the worm is written in MSVC, and bears the following characteristics:<br>
<br>
propagates via email, constructing outgoing messages with its own SMTP engine <br>
propagates over network shares (not confirmed in testing yet) <br>
Note: The worm carries garbage data appended to end of file, so exact filesize and file checksum may vary.<br>
<br>
Installation <br>
<br>
The worm copies itself onto the victim machine as WINPPR32.EXE into %Windir%, for example:<br>
<br>
C:\WINNT\WINPPR32.EXE <br>
A configuration file is also dropped to %Windir%:<br>
<br>
C:\WINNT\WINSTT32.DAT <br>
The following Registry keys are added to hook system startup:<br>
<br>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run<br>
"TrayX" = %Windir%\WINPPR32.EXE /sinc <br>
<br>
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run<br>
"TrayX" = %Windir%\WINPPR32.EXE /sinc <br>
Mail Propagation <br>
<br>
The worm mails itself to email addresses harvested from the victim machine, using its own SMTP engine to construct outgoing messages. Target email addresses are harvested from files with the following extensions:<br>
<br>
DBX <br>
HLP <br>
MHT <br>
WAB <br>
EML <br>
TXT <br>
HTM <br>
HTML <br>
Outgoing messages are constructed as follows:<br>
<br>
Subject: <br>
<br>
Your details <br>
Thank you! <br>
Re: Thank you! <br>
Re: Details <br>
Re: Re: My details <br>
Re: Approved <br>
Re: Your application <br>
Re: Wicked screensaver <br>
Re: That movie <br>
Attachment: <br>
<br>
your_document.pif <br>
document_all.pif <br>
thank_you.pif <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< the one we got(Terry)<br>
your_details.pif <br>
details.pif <br>
document_9446.pif <br>
application.pif <br>
wicked_scr.scr <br>
movie0045.pif <br>
Body: <br>
<br>
See the attached file for details <br>
Please see the attached file for details <br>
The "From:" address may be spoofed with an address extracted from the victim machine. Therefore the perceived sender is most likely not a pointer to the infected user.<br>
<br>
Contacting Remote NTP Servers <br>
<br>
The worm contains a list of IP addresses for remote NTP servers, to which it sends NTP packets (destination port 123).<br>
<br>
Self-Termination <br>
<br>
In common with previous W32/Sobig variants, this variant contains a date triggered self-termination routine. If the date is September 10th 2003 or later, the worm will no longer propagate.<br>
<br>
<br>
<br>
Indications of Infection <br>
<br>
Existence of the WINPPR32.EXE file in %WinDir% <br>
Existence of the Registry hooks detailed above <br>
Unexpected NTP traffic to remote servers <br>
<br>
<br>
<br>
Method of Infection <br>
<br>
This worm propagates via email (contains its own SMTP engine) and over network shares.<br>
<br>
<br>
<br>
Removal Instructions <br>
<br>
DAT Files <br>
Detection is included in the 4287 DAT files. In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used. Alternatively, the following EXTRA.DAT packages are available (HOW TO use an EXTRA.DAT).. <br>
<br>
EXTRA.DAT - should be extracted to the same directory where CLEAN.DAT, NAMES.DAT, and SCAN.DAT are (typically C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx) <br>
or<br>
<br>
SUPER EXTRA.DAT - EXTRA.DAT self installer <br>
Stand Alone Remover <br>
Stinger has been updated to include detection/removal of this threat. <br>
Manual Removal Instructions <br>
To remove this virus "by hand", follow these steps: <br>
<br>
- Win9x/ME - Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode. <br>
- WinNT/2K/XP - Terminate the process WINPPR32.EXE <br>
Delete the following files from your WINDOWS directory (typically c:\windows or c:\winnt) <br>
WINPPR32.EXE <br>
WINSTT32.DAT <br>
Edit the registry <br>
Delete the "TrayX" value from <br>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ <br>
Windows\CurrentVersion\Run <br>
HKEY_CURRENT_USERS\SOFTWARE\Microsoft\ <br>
Windows\CurrentVersion\Run <br>
Additional Windows ME/XP removal considerations<br>
<br>
<br>
<br>
Aliases <br>
<br>
W32.Sobig.F@mm (NAV), WORM_SOBIG.F (Trend) <br>
<br>
<br>
Dr Terry L Marshall, B.A.(Law), M.B.,Ch.B.,F.R.C.Path<br>
Consultant Pathologist<br>
Rotherham General Hospital<br>
South Yorkshire<br>
England<br>
terry.marshall@rothgen.nhs.uk<br>
<br>
_______________________________________________<br>
Histonet mailing list<br>
Histonet@lists.utsouthwestern.edu</font>
<br><font size=2 face="Courier New">http://lists.utsouthwestern.edu/mailman/listinfo/histonet<br>
</font>
<br>
<br>