To: Johnnypatriots
Trend Micro Weekly Virus Report
(by TrendLabs Global Antivirus and Research Center)
Date: January 17, 2003
Issue Preview:
1. Trend Micro Updates - Pattern File & Scan Engine Updates
2. It's Huge - WORM_SOBIG.A (Medium Risk)
3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
1. Trend Micro Updates - Pattern File and Scan Engine Updates
PATTERN FILE: 443
SCAN ENGINE: 6.510
2. It's Huge - WORM_SOBIG.A (Medium Risk) WORM_SOBIG.A is a memory-resident, multi-threaded worm that propagates via email and shared network folders. It sends copies of itself via email using its own Simple Mail Transfer Protocol (SMTP) engine and obtains its target recipients from addresses found in files with the following extensions:
WAB
DBX
HTM
HTML
EML
TXT
The details of the email that it sends are as follows:
Sender:
big@boss.com
Subject:
Re: Movies
Re: Sample
Re: Document
Re: Here is that sample
Attachment:
Movie_0074.mpeg.pif
Document003.pif
Untitled1.pif
Sample.pif
The worm also copies itself to shared folders on the Local Area Network that contain the following folders: :
Windows\All Users\Start Menu\Programs\StartUp\
Documents and Settings\All Users\Start Menu\Programs\Startup
WORM_SOBIG.A downloads files from remote Web sites, and saves them to the Windows folder as DWN.DAT. This download contains a link to another file on the Internet. The worm downloads this file, which may be changed anytime, and then executes it on the host system. If you would like to scan your computer for WORM_SOBIG.A or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at:http://housecall.trendmicro.comWORM_SOBIG.A is detected and cleaned by Trend Micro pattern file #436 and above.
3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
(week of: January 6, 2003 to January 12, 2003)
WORM_KLEZ.H
WORM_YAHA.K
JS_EXCEPTION.GEN
JS_NOCLOSE.E
JS_SEEKER.E1
WORM_OPASERV.E
WORM_BUGBEAR.A
WORM_OPASERV.H
WORM_OPASERV.A
WORM_OPASER
