A virulent email worm began spreading earlier this week named Sobig.F.On Friday, August 22nd Avvanta Online Services began filtering for this virus on all of our incoming mail servers. Filtering however is not a guarantee of safety. You are encouraged to install and/or update your Anti Virus Software to innoculate themselves from the threat of this worm.
The worm spreads by emailing itself using it's own SMTP engine. It collects email addresses from files on the infected computer, then sends out a message with the following characteristics: Subject: (randomly selected from the following)
- Re: Thank you!
- Thank you!
- Re: Details
- Re: Re: My details
- Re: Approved
- Re: Your application
- Re: Wicked screensaver
- Re: That movie
- Your details
The sending address the worm uses is also selected randomly from the same list of addresses the worm attempts to send itself to. (ie, the worm "spoofs" the From address) This can cause you to receive "error" messages for emails they never sent. This can also cause you to receive warnings from poorly configured Anti-Virus mail servers about "un-safe content you sent" - when in fact you sent no such content. The worm simply used your email address and you are getting the replies and bounce notices. The message directs you to open the attachment, which can use any of the following file names:
- your_document.pif
- document_all.pif
- thank_you.pif
- your_details.pif
- details.pif
- document_9446.pif
- application.pif
- wicked_scr.scr
- movie0045.pif
Anti Virus Software Vendors:
|
