Worm/Sobig.D - Worm

See also

Full description

Alias:	W32.Sobig.D@mm
Type:	Worm
Size:	59 kbytes
Origin:	unknown
Date:	06-18-2003
Damage:	Email and Internet spreading
VDF Version:	6.20.00.13 - Wed, 18 Jun 2003 14:28 (GMT+1)
Danger:	Low
Distribution:	Medium

General DescriptionWorm/Sobig.D has a file size of ca. 59 kbytes. When the worm file is opened, it copies itself in the Windows directory as CFTRB32.EXE and makes the file RSSP32.DAT. It looks for email addresses in files of type .HTML, .HTM, .TXT, .EML and using its SMTP engine it will send itself to these.

Worm/Sobig.D can look in the local network for the following paths:
* \Documents and Settings\All Users\Start Menu\Programs\Startup\
* \Windows\All Users\Start Menu\Programs\StartUp\
and it copies itself there, so that the next system start will activate it.

SymptomsThe ~59 kbytes file "CFTRB32.EXE" appears in the Windows directory.

Distribution- Email sending
- Local networks

Technical DetailsWorm/Sobig.D is ca. 59 kbytes, packed with UPX. When started, it copies itself in Windows directory as cftrb32.exe and makes the file rssp32.dat. In this file it gathers the email addresses it found in the local files of type .HTML, .HTM, .TXT, .EML and .WAB. These email addresses are saved encoded.

It makes the following register entries:
* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"SFtrb Service"="%Windir%\cftrb32.exe"

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"SFtrb Service"="%Windir%\cftrb32.exe "

If the worm can find the following paths in the local network, it copies itself there:
* \Documents and Settings\All Users\Start Menu\Programs\Startup
* \Windows\All Users\Start Menu\Programs\StartUp

Worm/Sobig.D spreads itself by email. The subject can look like this:
* Application Ref: 456003
* Re: Accepted
* Re: App. 00347545-002
* Re: Documents
* Re: Movies
* Re: Screensaver
* Re: Your Application (Ref: 003844)
* Your Application

The body has this text:
See the attached file for details.

The attachment has one of the following names:
* Applications.pif
* Accepted.pif
* App00347545.pif
* Document.pif
* Movies.pif
* Screensaver.pif
* Screensaver.scr
* Application884.pif
* Application.pif

Manual Remove Instructions- for Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* cftrb32.exe
* rssp32.dat

Start "regedit" after that and delete the following registry entries:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"SFtrb Service"="%Windir%\cftrb32.exe"

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"SFtrb Service"="%Windir%\cftrb32.exe"

Restart your computer.

- for Windows 9x/Me:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* cftrb32.exe
* rssp32.dat

Start "regedit" after that and delete the following registry entries:

* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run]
"SFtrb Service"="%Windir%\cftrb32.exe"

Restart your computer.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back