|
Our VIRUS Alert Post 2003
|
|
|
Here you will find
recent virus alerts...
|
|
|
|
|
Top ten viruses reported to Sophos in July 2003
This section helps you to understand how it behaves
This worm arrives via email and attempts to travel via network shares. The
worm sends itself as an attachment to email addresses collected from
infected computers.
A typical email has the following format:
Subject line:
Re: Application
or
Re: Movie
Message text:
Please see the attached zip file for details
Attached file:
your_details.zip (containing details.pif)
W32/Sobig-E may spoof the From field of the sent emails using the email
address support@yahoo.com or addresses collected from the user's computer.
When run W32/Sobig-E copies itself into the Windows folder as winssk32.exe
and sets the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSK Service
= <Windows folder>\winssk32.exe
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSK Service
= <Windows folder>\winssk32.exe
Like previous variants W32/Sobig-E attempts to spread in Windows shares by
copying itself into the following folders on shares:
Windows\All Users\Start Menu\Programs\StartUp\
Documents and Settings\All Users\Start Menu\Programs\Startup\
W32/Sobig-E will not spread if the date is 14th July or later
|
|
| This web is
optimized for 800 x 600 monitor resolution or above and the latest web
browser. Get the latest IE or Netscape web browser. (you need to
connect to the internet first) |
|
