Win32.Sobig.F@mm Removal Tool 1.0 Description:

Name: Win32.Sobig.F@mm
Aliases: W32/Sobig.F@mm
Type: Executable Mass Mailer
Size: ~70 KB
Discovered: 19.08.2000
Spreading: High
Damage: Low
In The Wild: Yes

Symptoms:
Registry keys:
HKLMSoftwareMicrosoftWindowsRunCurrentVersionTrayX with value:
%WINDIR%winppr32.exe /sinc
HKCUSoftwareMicrosoftWindowsRunCurrentVersionTrayX with value:
%WINDIR%winppr32.exe /sinc

Following files in the %WINDIR% folder:

Winstt32.dat
Winppr32.exe
Winstf32.dll

Technical description:

It arrives in e-mail in the following format:

Subject:
Randomly chosen from the following list:
"Re: Wicked screensaver"
"Re: That movie"
"Re: Your application"
"Re: Approved"
"Re: Re: My details"
"Re: Details"
"Your details&quo

Body:
Please see the attached file for details.
Or
See the attached file for details

Attachment:
Randomly chosen from the following list:
"movie0045.pif"
"wicked_scr.scr"
"application.pif"
"document_9446.pif"
"details.pif"
"your_details.pif"
"thank_you.pif"
"document_all.pif"
"your_document.pif "

After the user opens the attachment the worm copies in the following location:
%WINDIR%winppr32.exe
and adds the following registry keys:
HKLMSoftwareMicrosoftWindowsRunCurrentVersionTrayX with value:
%WINDIR%winppr32.exe /sinc

HKCUSoftwareMicrosoftWindowsRunCurrentVersionTrayX with value:
%WINDIR%winppr32.exe /sinc

It searches for e-mails in the following file types:
html, wab, mht, hlp, txt, eml, htm, dbx

The worm also spreads trough network shares.
After the 10.09.2003 it stops spreading

Removal instructions:

The BitDefender Virus Analyse Team has releasead a free removal tool for this particular virus.

Important: You will have to close all applications before running the tool (including the antivirus shields) and to restart the computer afterwards. Additionally you'll have to manually delete the infected files located in archives and the infected messages from your mail client.

The BitDefender Antisobig-en.exe tool does the following:
· it detects all the known Sobig versions;
· it deletes the files infected with Sobig;
· it kills the process from memory;
· it repairs the Windows registry

You may also need to restore the affected files.

To prevent the virus from replicating itself from infected machines to clean machines, you should try to disinfect all computers in the network before rebooting any of them, or unplug the network cables.

Win32.Sobig.F@mm Removal Tool security information

You cannot download any crack or serial number for Win32.Sobig.F@mm Removal Tool on this page. Every software that you are able to download on our site is legal. There is no crack, serial number, hack or activation key for Win32.Sobig.F@mm Removal Tool present here. Our collection also doesn't contain any keygens, because keygen programs are being used in illegal ways which we do not support. All software that you can find here is freely downloadable and legal.

Win32.Sobig.F@mm Removal Tool installation package is prepared to be downloaded from our fast download servers. It is checked for possible viruses and is proven to be 100% clean and safe. Various leading antiviruses have been used to test Win32.Sobig.F@mm Removal Tool, if it contains any viruses. No infections have been found and downloading Win32.Sobig.F@mm Removal Tool is completelly problem free because of that reason. Our experts on malware detection tested Win32.Sobig.F@mm Removal Tool with various spyware and malware detection programs, including fyxm.net custom malware and spyware detection, and absolutelly no malware or spyware was found in Win32.Sobig.F@mm Removal Tool.

All software that you can find on our servers, including Win32.Sobig.F@mm Removal Tool, is either freeware, shareware or open-source, some of the software packages are demo, trial or patch versions and if possible (public domain licence), we also host official full versions of software.

Because we want to be one of the fastest download sites on the web, we host all the software including Win32.Sobig.F@mm Removal Tool on our servers. You cannot find here any torrents or download links that would lead you to dangerous sites.

Fyxm.net does support free software, however we do not support warez or illegal downloads. Warez is harming producers of the software.

Enjoy!