The Sobig Worm was a computer worm that infected millions of

Internet The Internet (or internet) is the Global network, global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a internetworking, network of networks ...

-connected,

Microsoft Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...

computers in August 2003. Although there were indications that tests of the worm were carried out as early as August 2002, Sobig.A was first found in the wild in January 2003. Sobig.B was released on May 18, 2003. It was first called ''Palyh'', but was later renamed to Sobig.B after

anti-virus Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware. Antivirus software was originally developed to detect and remove computer viruses, hence the name ...

experts discovered it was a new generation of Sobig. Sobig.C was released May 31 and fixed the timing bug in Sobig.B. Sobig.D came a couple of weeks later followed by Sobig.E on June 25. On August 19, Sobig.F became known and set a record in sheer volume of e-mails. The worm was most widespread in its "Sobig.F" variant. , Sobig is the second fastest computer worm to have ever entered the wild, being surpassed only by

Mydoom Mydoom was a computer worm that targeted computers running Microsoft Windows. It was first sighted on January 26, 2004. It became the fastest-spreading e-mail worm ever, exceeding previous records set by the Sobig worm and ILOVEYOU, a record wh ...

. Sobig was not only a

computer worm A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It will ...

in the sense that it replicates by itself, but also a

Trojan horse In Greek mythology, the Trojan Horse () was a wooden horse said to have been used by the Greeks during the Trojan War to enter the city of Troy and win the war. The Trojan Horse is not mentioned in Homer, Homer's ''Iliad'', with the poem ending ...

in that it masquerades as something other than

malware Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...

. The Sobig.F worm would appear as an

electronic mail Electronic mail (usually shortened to email; alternatively hyphenated e-mail) is a method of transmitting and receiving Digital media, digital messages using electronics, electronic devices over a computer network. It was conceived in the ...

with one of the following subjects: * Re: Approved * Re: Details * Re: Re: My details * Re: Thank you! * Re: That movie * Re: Wicked screensaver * Re: Your application * Thank you! * Your details It would contain the text: "See the attached file for details" or "Please see the attached file for details", as well as an attachment as one of the following names: * application.pif * details.pif * document_9446.pif * document_all.pif * movie0045.pif * thank_you.pif * your_details.pif * your_document.pif * wicked_scr.scr

Technical details

The Sobig viruses infected a host computer by way of the above-mentioned attachment. When this is started they will replicate by using their own

SMTP The Simple Mail Transfer Protocol (SMTP) is an Internet standard communication protocol for electronic mail transmission. Mail servers and other message transfer agents use SMTP to send and receive mail messages. User-level email clients typi ...

agent engine. E-mail addresses that will be targeted by the virus are gathered from files on the host computer. The

file extension File or filing may refer to: Mechanical tools and processes * File (tool), a tool used to remove fine amounts of material from a workpiece. ** Filing (metalworking), a material removal process in manufacturing ** Nail file, a tool used to gen ...

s that will be searched for e-mail addresses are: * .dbx * .eml * .hlp * .htm * .html * .mht * .wab * .txt The Sobig.F variant was programmed to contact 20 IP addresses on UDP port 8998 on August 26, 2003 to install some program or update itself. It is unclear what this program was, but earlier versions of the virus had installed the WinGate proxy server software—a legitimate product—in a configuration allowing it to be used as a backdoor for spammers to distribute unsolicited e-mail. The Sobig worm was written using the Microsoft Visual C++ compiler, and subsequently compressed using a data compression program called tElock. The Sobig.F worm deactivated itself on September 10, 2003. On November 5 the same year,

Microsoft Microsoft Corporation is an American multinational corporation and technology company, technology conglomerate headquartered in Redmond, Washington. Founded in 1975, the company became influential in the History of personal computers#The ear ...

announced that they will pay $250,000 for information leading to the arrest of the creator of the Sobig worm. Ruslan Ibragimov is attributed to be the original creator of the worm, however this is not confirme

Technical details

References

See also