This application requires Javascript for optimal performance.

Sobig.F.Email

Alias(es)

Win32/Sobig.F.C, Win32/Sobig.F.A, Win32/Sobig.F.B

Release Date

Sep 11, 2006

Severity

high

Impact

System compromise.

Description

This indicates detection of email attachments that may be infected by the Sobig.F worm.

Sobig.F is a network worm that spreads through infected e-mail attachments. Characteristic attachments usually have .pif or .scr extensions. Sobig.F forges the sender field of a message and specifies either "Please see the attached file for details" or "See the attached file for details" as the message body.

The subject line of the infected messages may be any of the following:

Your details

Thank you!

Re: Thank you!

Re: Details

Re: Re: My details

Re: Approved

Re: Your application

Re: Wicked screensaver

Re: That movie

Affected Products

Any unprotected Microsoft Windows system is vulnerable to the attack.


Recommended Actions

Use antivirus software to scan all vulnerable computers.

Upgrade all Microsoft Windows systems to the patch level.

Coverage

IPS
VCM

Reference/s

http://www.cert.org/incident_notes/IN-2003-03.html
http://www.fortinet.com/ve?fid=440

Reference: VID-12952