How the SoBig.F virus works

The latest incarnation of the SoBig worm has been devastating mail servers all over the Internet. SoBig was first spotted in the wild, in January. Since then, several new versions have popped up; the latest and most virulent, SoBig.F was first spotted on August 18th and has been wreaking havoc since.

This latest version of SoBig is especially nasty because it uses techniques from other worms, Trojans and even spammers to replicate itself and infect other systems. The most frustrating aspect of the SoBig worm to system administrators is the fact that the worm won't infect a system without the cooperation of a mail user.

Infectious beginnings

All of the SoBig variants are spread as an email attachment with either a ".pif" of ".scr" extension. The file names vary with each version of the worm, but the ones used by SoBig.F are listed in Figure A below.

Unlike other worms that take advantage of bugs in mail clients to automatically execute attachments, SoBig relies on enticing the email user to open the attachment manually. Because the email generally appears to come from someone they know many users end up opening the attachment and infecting their machine.

First wave: replication

Once run, SoBig.F will copy itself to your Windows directory as winppr32.exe and add registry entries to automatically start every time you boot your computer or login. Once installed and running SoBig.F will scour your hard disks for certain files and harvest any email addresses found within, creating a massive list of targets. Table A, above, lists the file extensions SoBig.F looks for.

SoBig.F doesn't rely on an installed mail client to send itself out (although it can); it comes with its own SMTP server to blast itself to its target list. SoBig will use email addresses from its target list as a spoofed "From" address in the mail envelope in order to make these messages appear to be more legitimate. SoBig.F uses carefully crafted subject lines to complete the illusion of a valid email from someone you know.

Second wave: is the cure worse then the disease?

Shortly after the worm was first seen in the wild and analyzed, most anti-virus vendors sent out immediate updates to their virus definitions to find and block SoBig.F. While some systems were already infected and infecting others, many other users were being protected by gateway and mail server anti-virus scanning products. These scanning products find the SoBig worm and either reject the message or clean it. The logic built into many of these products compounded the SoBig problem.