The Sobig Worm was a computer worm that infected millions of

Internet The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...

-connected,

Microsoft Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...

computers in August 2003. Although there were indications that tests of the worm were carried out as early as August 2002, Sobig.A was first found in the wild in January 2003. Sobig.B was released on May 18, 2003. It was first called ''Palyh'', but was later renamed to Sobig.B after

anti-virus Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware. Antivirus software was originally developed to detect and remove computer viruses, hence the name. ...

experts discovered it was a new generation of Sobig. Sobig.C was released May 31 and fixed the timing bug in Sobig.B. Sobig.D came a couple of weeks later followed by Sobig.E on June 25. On August 19, Sobig.F became known and set a record in sheer volume of e-mails. The worm was most widespread in its "Sobig.F" variant. , Sobig is the second fastest computer worm to have ever entered the wild, being surpassed only by

Mydoom mydoom also known as, my.doom, W32.MyDoom@mm, Novarg, Mimail.R, Shimgapi, W32/Mydoom@MM, WORM_MYDOOM, Win32.Mydoom is a computer worm affecting Microsoft Windows. It was first sighted on January 26, 2004. It became the fastest-spreading e-mail worm ...

. Sobig is not only a

computer worm A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It wil ...

in the sense that it replicates by itself, but also a

Trojan horse The Trojan Horse was a wooden horse said to have been used by the Greeks during the Trojan War to enter the city of Troy and win the war. The Trojan Horse is not mentioned in Homer's ''Iliad'', with the poem ending before the war is concluded, ...

in that it masquerades as something other than

malware Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...

. The Sobig.F worm will appear as an

electronic mail Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronics, electronic (digital media, digital) version of, or counterpart to, mail, ...

with one of the following subjects: * Re: Approved * Re: Details * Re: Re: My details * Re: Thank you! * Re: That movie * Re: Wicked screensaver * Re: Your application * Thank you! * Your details It will contain the text: "See the attached file for details" or "Please see the attached file for details." It also contains an attachment by one of the following names: * application.pif * details.pif * document_9446.pif * document_all.pif * movie0045.pif * thank_you.pif * your_details.pif * your_document.pif * wicked_scr.scr

Technical details

The Sobig viruses infect a host computer by way of the above-mentioned attachment. When this is started they will replicate by using their own

SMTP The Simple Mail Transfer Protocol (SMTP) is an Internet standard communication protocol for electronic mail transmission. Mail servers and other message transfer agents use SMTP to send and receive mail messages. User-level email clients typical ...

agent engine. E-mail addresses that will be targeted by the virus are gathered from files on the host computer. The

file extension A filename extension, file name extension or file extension is a suffix to the name of a computer file (e.g., .txt, .docx, .md). The extension indicates a characteristic of the file contents or its intended use. A filename extension is typically d ...

s that will be searched for e-mail addresses are: * .dbx * .eml * .hlp * .htm * .html * .mht * .wab * .txt The Sobig.F variant was programmed to contact 20

IP addresses An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...

on UDP port 8998 on August 26, 2003 to install some program or update itself. It is unclear what this program was, but earlier versions of the virus had installed the

WinGate Wingate may refer to: Places New Zealand * Wingate, New Zealand, a suburb of Lower Hutt United Kingdom * Wingate, County Durham * Wingate Quarry, a Site of Special Scientific Interest in County Durham * Old Wingate, County Durham * Wingat ...

proxy server In computer networking, a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. Instead of connecting directly to a server that can fulfill a request ...

software—a legitimate product—in a configuration allowing it to be used as a

backdoor A back door is a door in the rear of a building. Back door may also refer to: Arts and media * Back Door (jazz trio), a British group * Porta dos Fundos (literally “Back Door” in Portuguese) Brazilian comedy YouTube channel. * Works so title ...

for

spammers This is a list of individuals and organizations noteworthy for engaging in bulk electronic spamming, either on their own behalf or on behalf of others. It is not a list of all spammers, only those whose actions have attracted substantial independen ...

to distribute unsolicited e-mail. The Sobig worm was written using the Microsoft Visual C++ compiler, and subsequently compressed using a data compression program called tElock. The Sobig.F worm deactivated itself on September 10, 2003. On November 5 the same year,

Microsoft Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washing ...

announced that they will pay $250,000 for information leading to the arrest of the creator of the Sobig worm. To date, the perpetrator has not been caught.

Technical details

See also