SoBig is so prevalent, as sixth variant mass mails itself around the world
A new variant of the SoBig worm has been filling inboxes worldwide, after it was mass-mailed to millions of email addresses.
The worm arrives as a .Pif (Program Information file) attachment in emails with the headers:
Re: That movie
Re: Wicked screensaver
Re: Your application
Re: Approved
Re: Re: My details
Re: Details
Your details
Thank you!
The worm is 72,000 bytes. Once activated it copies itself to Windows as 'winppr32.exe' and edits the registry to ensure that it starts whenever the computer boots.
All email addresses on the PC are collected and are then sent copies of the worm using the worm's own SMTP engine.
Source:
http://www.vnunet.com/
Hybrid Mode
