Virus Alert: Sobig - W32.Sobig.A@mm

Posted on Friday, January 17, 2003

A new virus, known as Sobig, is spreading rapidly throughout Penn State and the world. The virus appears to attack Windows machines running Microsoft Corporation's Outlook e-mail client. This mass-mailing worm arrives via e-mail in a message from the address big@boss.com. It carries one of four subject lines:

• Re: Movies
• Re: Document
• Re: here is that sample
• Re: Sample

The message also includes an attachment that could include one of the following filenames:

• Document003.pif
• Sample.pif
• Movie_0074.mpeg.pif
• Untitled1.pif

Sobig uses its own SMTP (simple mail transfer protocol) engine to mail copies of itself to addresses that it finds on the infected machine's hard drive and e-mail address book. The virus also copies itself to two shared folders on shared network drives. Additional information about this virus is available at: http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.a@mm.html

Users are urged to install an anti-virus program. If you already own one, be sure the virus definition files are up-to-date. Penn State purchased a site license for Symantec's Norton Antivirus software that makes the product available to faculty, staff, and students at no cost. Information is available on Penn State Computer Store's web site at: http://computerstore.psu.edu/softwaredist/

If you have additional questions or need assistance with the antivirus software or updating your virus definition files, contact the ITS Consulting and Support Help Desk at (814) 863-2494 or (814) 863-1035. If you receive an infected e-mail, please forward it (with full headers showing so it can be traced) to virus@psu.edu.

General information and guidance on viruses can also be found on the ITS Virus Information web site at http://its.psu.edu/virus.html.