Virus Alert: W32.Sobig.E@mm Worm

A recently discovered variant of the W32.Sobig.A@mm worm poses a threat to Windows operating systems. W32.Sobig.E@mm is a mass-mailing worm that sends itself to all the email addresses that it finds in files with the certain extensions (.html, .txt, etc.) Symantec Antivirus does detect this worm if you have the latest LiveUpdate virus definition file (6/25/2003 rev 19 or newer).

• The worm is sent as an email attachment with with various subject lines. The two subject lines seen at Penn state are re: Movie and re: Application
• The From: line of the message is forged so it can appear to come from anywhere
• The attachment is a .zip file containing a .pif file.
• It also attempts to copy itself to shared resources

http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.e@mm.html

Here are recommendations on protecting yourself from this and other viruses and worms:

• If you have antivirus software installed on your computer, download the latest virus definition files.
• If you do not have antivirus software installed, obtain Symantec Antivirus software at no cost through Penn State Computer Store's Web site http://computerstore.psu.edu/softwaredist/ or obtain the PAC-ITS CD at ITS Help Desk locations. (Note that departments ordering the software from the Computer Store must pay for the cost of the media which is $3.00.)
• Scan your entire system for "missed" viruses, now and weekly. Virus definition files should be updated every week, or more often if you hear that a virus or worm is spreading.

If you have additional questions or need assistance, contact the ITS Help Desk at (814) 863-2494 or (814) 863-1035. If you receive an infected e-mail, please forward it (with full headers showing so it can be traced) to virus@psu.edu. General information and guidance on viruses can also be found on the ITS Virus Information web site at http://its.psu.edu/virus.html.