Theos-Talk Archives (September 2003 Message tt00016)

The following information may be pertinent to the virus problem reported by 
Eldon.

(I wrote this a week ago to everyone on my mail list who might receive an 
attachment from me or any other friend.)

There is a mean virus/worm going around that affects Windows machines and 
captures your mailing lists to send out replicas of itself using your and your 
friends return addresses. So please do not download any attachment that ends 
with the extension .pif or .scr in letters that appear to come from me or any 
other friends. The worm already took my name off somebody's list and the worm 
is circulating all over the world with my return address on it. So, be 
careful. (Any other safe download files that come from me will always be accompanied 
by a personal note.)

The following is information on this virus offered by AOL:

The "Sobig" worm, also known as W32.Sobig.f@mm, is a malicious program 
circulating on the Internet. If your computer becomes infected with the worm, an 
unauthorized person can remotely download and run programs on your computer, 
stealing confidential information from you, or use your computer to send spam. 

What's happening now?

Security experts have just determined that the Sobig.f worm is designed to 
wake up at 3 p.m. ET on Fridays and maybe also on Sundays and download an 
unknown program to an infected computer. The program could be something malicious or 
it could be something benign.

Can this happen to me?

Yes, if you use Windows and are infected with the worm. The worm can infect 
Windows 95, 98, ME, NT, 2000, and XP. Macintosh operating systems are 
unaffected by this worm. 

How Can I Protect Myself?

1. Be careful and don't get infected with the worm. Don't download any e-mail 
attachments, even from people you know, with any of the following subject 
lines:

    -    Re: Details
    -    Re: Approved
    -    Re: Re: My details!
    -    Re: Thank you!
    -    Re: That movie
    -    Re: Wicked screensaver
    -    Re: Your application
    -    Thank you
    -    Your details

The e-mail attachment might have one of the following names:

    -    your_document.pif
    -    document_all.pif
    -    thank_you.pif
    -    your_details.pif
    -    document_9446.pif
    -    application.pif
    -    wicked_scr.scr
    -    movie0045.pif

For more information, go to:
http://www.computerworld.com/securitytopics/security/holes/story/0,10801,84214
,00.html