W32/Sobig.D Worm

 Information about the W32/Sobig.D worm:

W32/Sobig.D is an email worm. It is a variant of W32/Sobig.A. This worm will infect Windows systems. The worm spreads through email and shared drives on network.

The worm arrives as an email having the from address as admin@support.com or any random address picked from the infected system. The subject of the infected mail will be any one of the following;

Your Application
Re: Your Application (Ref: 003844)
Re: Screensaver
Re: Movies
Re: Documents
Re: App. 00347545-002
Re: Accepted Application Ref: 456003

The content of the mail will be;

See the attached file for details

The infected attachment will have any one of the following names;

screensaver.scr
ref_456.pif
movies.pif
document.pif
applications.pif
application844.pif
application.pif
app003475.pif
accepted.pif

When the infected attachment is executed, the worm copies itself as cfrtb32.exe under the Windows folder. The worm modifies registry at the following location to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm attempts to find the shared resources on the network and tries to copy itself under the following folders of the target system;

Windows\All Users\Start Menu\Programs\StartUp
Documents and Settings\All Users\Start Menu\Programs\Startup

The worm tries to collect all the email addresses found in the files having the following extensions;

.txt
.eml
.html
.htm
.dbx
.wab

and stores these addresses in encrypted format as rssp32.dat in Windows folder. The worm tries to mail itself to these email addresses using its own SMTP engine.

This worm first appeared on 18th June 2003.

 Other names of W32/Sobig.D worm:

This worm is also known as W32/Sobig.d@MM , W32/Sobig-D, W32.Sobig.D@mm