Web Worm Sobig, So Fast
It's a record, but not one that people who use e-mail are all that thrilled about. The virus that made its debut this week is being called the fastest-spreading e-mail virus of all time.
Message Labs Incorporated, a company that filters e-mail for corporate clients around the world says it intercepted more than 1 million copies of the Sobig.F virus on Tuesday. That's the most it has picked off in a single day.
The company says one out of every 17 e-mail messages the firm scanned was infected with the virus.
Meanwhile, another malicious program that hit last week is continuing to disrupt computers around the world. The Blaster worm continues to cause problems as is the derivative Nachi or Welchia, which are supposed to help shield computers from the Blaster worm.
Nachi and Welchia wreaked havoc Tuesday with Air Canada's airline reservation systems, creating long lines at the Vancouver airport as weary travelers were forced to check in manually.
Nachi/Welchia also popped up in various nooks and crannies in the United States, including Kentucky, where it interfered with state government computers which handle motor vehicle registration, Medicaid, food stamps, and child support.
"This new worm doesn't destroy the PC or do anything real harmful, but it starts sending out scans across the network," says Rodney Murphy, of the Kentucky Governor's Office for Technology, adding that the scans clog phone lines and can cause serious delays. "It can degrade the speed of a workstation to the point of being no different than shutting a PC down."
Sobig.F, on the other hand, attacks Windows users via e-mail and file-sharing networks. It also deposits a Trojan horse, or hacker back door, that can be used to turn victims' PCs into senders of spam e-mail.
How can you tell if Sobig.F has come to call on you?
Subject lines for Sobig.F include: "Re:Details," "Re: Approved," "Re: Re: My details," "Re: Thank you!", "Re: That movie," "Re: Wicked screensaver," "Re: Your application," "Thank you!", and "Your details."
The message is likely to say: "See the attached file for details" or "Please see the attached file for details."
Attached files are likely to be: "your_document.pif," "document_all.pif," "thank_you.pif," "your_details.pif," "details.pif," "document_9446.pif," "application.pif," "wicked_scr.scr," or "movie0045.pif."
As is the case with many computer viruses, the trouble is unleashed if a recipient clicks on the attached file, at which point the computer will become infected.
Sobig.F sends itself out to names found in its victim's address books and will use one of these names to forge a return address. As such, the infected party may not quickly learn of the infection, while an innocent party may get the blame for helping to propagate it.