Alias:Win32.Sorbig.A@mm
Type:Worm 
Size:65,536 bytes 
Origin:unknown 
Date:01-09-2003 
Damage: 
VDF Version:  
Danger:Low 
Distribution:Medium 

General DescriptionWorm/Sorbig.A is searching the *.txt, *.eml, *.html, *.html, *.dbx, and *.wab files for email addresses and sends itself to these. A Trojan component will be downloaded from Internet.

Symptoms* The files and registry entries mentioned below.
* A backdoor component downloaded from Internet.

DistributionSends itself by email as executable .PIF. Worm/Sorbig.A can be activated directly from the Outlook Preview, without opening the attachment. For this it uses an existing security hole of Microsoft Outlook.

Technical DetailsWorm/Sorbig.A (65,536 bytes) is searching the *.txt, *.eml, *.html, *.html, *.dbx, and *.wab files for email addresses and sends itself to these. The email can look like this:

Subject:
Re: Movies
Or: Re: Sample
Or: Re: Document
Or: Re: Here is that sample

Body:

Attachment:
Movie_0074.mpeg.pif
Or: Document003.pif
Or: Untitled1.pif
Or: Sample.pif

When the attachment is open, the worm copies itself as:

* C:\Windows\Winmgm32.exe

and makes the following files:

* C:\Windows\reteral[1].txt
* C:\Windows\System\mptask.exe
* C:\Windows\System\sysmgm32.dll

Worm/Sorbig.A copies itself in all Autostart directories in all mapped network drives it can find. Then a registry entry is made, so that the worm will be activated by the next system start:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
"WindowsMGM"="C:\\WINDOWS\\winmgm32.exe"
"MPtask Services"="C:\\WINDOWS\\SYSTEM\\mptask.exe"

Finally, the worm loads the file "mptask.exe" from the following URL:

http://www.lorico****.com/users/***k/txtfile._

Manual Remove Instructions- for Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* Winmgm32.exe
* reteral[1].txt
* mptask.exe
* sysmgm32.dll

Start "regedit" after that and edit the following registry entry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
"WindowsMGM"="C:\\WINDOWS\\winmgm32.exe"
"MPtask Services"="C:\\WINDOWS\\SYSTEM\\mptask.exe"

Restart your computer.

- for Windows 9x/ME:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* Winmgm32.exe
* reteral[1].txt
* mptask.exe
* sysmgm32.dll

Start "regedit" after that and edit the following registry entry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
"WindowsMGM"="C:\\WINDOWS\\winmgm32.exe"
"MPtask Services"="C:\\WINDOWS\\SYSTEM\\mptask.exe"

Restart your computer.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .