Sobig virus and others

insurgent

Exhausted
Joined
Sep 26, 2001
Messages
3,779
Location
Right in front of you
Hi there!

Let me tell you a story about this week.
So, my mother receives a virus, the Ganda virus - an old mail worm - and she uses Outlook Express. So, when she opens the mail program, and marks one of the recieved mails (possibly to delete them), it automatically opens in the lower half of the screen - a message example (that was the default - it sure as hell isn't anymore). So, the mail opens and so does the attachment, which was hidden as a .scr file - a screensaver - and is thus automatically initialised by the program.
But hey, nothing's wrong, we've got an anti-virus program - but in the splitsecond that the mail and the virus are initialised, the Norton Antivirus was updating (or at least that's the only answer I've been able to come up with) - and it was thus inactive. So, the computer is infected, but my mother doesn't know. She just moves on, business as usual.
But, alas, it wasn't business as usual. So, the computer begins acting strange - rebooting when told to shut down, and going slow and crashes at start. My mother calls me, and I take a look at it. I can't figure out what's wrong with the computer. And Norton is dead. I just can't open it. I try to fix it, but no, it just won't start. I download alternate anti-virus programs - they crash too. Hmm... something is seriously wrong, I thought.
My mother then downloads some program - the name of which I have forgotten now - shareware I think. It scans the computer, and it's obvious that it's been infected from top to bottom with that dreadful virus.
Being a shareware version, it is unable to remove the virus, so my search for alternate anti-virus programs continues. Without luck, until I get some program called Dr. Web, which is able to run - even though it couldn't finish the installation. According to it, about 120 files - all exes - are infected by now. But all it can do is delete them. Foolishly - at around 3 AM, deadtired and lacking ability to focus after a long day and evening of struggling with the virus - I tell it to do that.
Not long after, I realise that I've just deleted explorer.exe without backing up my mother's files. Crap, I think. Now it won't start, won't allow me to reach DOS, won't allow me to do anything at all.
Desperately I make a system restore, and all my mother's files are lost. Now, this really pisses me off, and for a while, I've been trying to make up for the damage by helping my mother with the computer.
Later I find out that the reason the anti-virus programs didn't work was that the virus when it first infected the pc was able to block a number of programs with some specific words in their titles, such as Norton, McAffee, Virus, Anti-Virus, Kasparsky, Norman, and some others. It's damned hard to find anti-virus programs that aren't blocked by that.

But this has given me a new awareness of some things:
1. The people who make those viruses are sickos - they should be locked up and beaten.
2. It's damned serious when they warn against viruses.


So, I end up with a question:
It seems I receive this new W32.Sobig.F@mm virus every day in several mails - I immediately delete the mails without even opening them. And my virus program (updated Norton AntiVirus 2000, I believe) tells me I don't have any viruses. But something worries me. I receive these mails from AntiVirus programs telling me that a mail that was sent from my address contained the virus. Now, the receivers are not in my address book, and I've never heard of neither them nor the senders of the mails I receive with the virus.
The reason I'm certain I'm receiving the virus is that I recognise the subjects of the emails from something I read.

So, do any of you know what I should do? Can I prevent them from being sent to me, and can I prevent them from sending from my email address?

Thanks.
 
You may not have the Sobig virus. But someone you know probably does. IIRC what it does is reads the infected computer's contact book and fakes the sender as one of the entries. This is to hide the actual source.

In other words, your friend's computer sends the spam as if it was your computer. But the reciever of the spam does not know any better and thinks it is you. Thus that is why you are recieving the virus messages.

Nasty little bugger.
 
Well, that's not very nice of it, is it now? ;) ( :( )
 
LOL :lol: Maybe not nice, but effective for a virus. The infected person does not even know about the emails. Plus, it is the fastest spreading virus of all time.

I would send emails to anyone you think may have your email address and ask them to check their computers. Just tell them what the virus does and that it is spoofing your email.

Here is a news story about it
http://www.foxnews.com/story/0,2933,95325,00.html
 
Hmm... a lot of people have my email address... I'm secretary of a youth party branch in my city - I reckon a couple of hundred people have my email address...
 
:goodjob: CG! This is important for people to know.
 
I, for one, have been hit very hard by the SoBig virus. I receive about 40 infected messages per day, and if I don't check it constantly, I go over my mailbox quota. Not a good thing when you are expecting some important information for business to come through at any moment...
 
JV, I'm having the same problem.

CG, I don't think I'm actually infected - if I were, wouldn't the (updated) Norton AntiVirus program be able to detect it in a full system scan?
 
Originally posted by insurgent
CG, I don't think I'm actually infected - if I were, wouldn't the (updated) Norton AntiVirus program be able to detect it in a full system scan?

You are not infected. Norton AntiVirus definitions released on August 20, 2003 (the most current as of my posting) will find the Sobig virus. I do not know what the first definition to find it was. Just make sure you have the most recent.
 
Don't use Outlook... it is the premium virus propagation platform in the universe.

For example Mozilla Mail is genuinely a better e-mail client, and there aren't any known exploits to it, AFAIK...
 
I think I received 30 e-mails with this SoBig stuff. Lucky my ISP sends anti-virus warnings.
 
Top Bottom