Technical Details
The Sobig viruses infect a host computer by way of the above mentioned attachment. When this is started they will replicate by using their own SMTP agent engine. E-mail addresses that will be targeted by the virus are gathered from files on the host computer. The file extensions that will be searched for e-mail addresses are:
- .dbx
- .eml
- .hlp
- .htm
- .html
- .mht
- .wab
- .txt
The Sobig.F variant was programmed to contact 20 IP addresses on UDP port 8998 on August 26, 2003 to install some program or update itself. It is unclear what this program was, but earlier versions of the virus had installed the WinGate proxy server software - a legitimate product - in a configuration allowing it to be used as a backdoor for spammers to distribute unsolicited e-mail.
The Sobig worm was written using the Microsoft Visual C++ compiler, and subsequently compressed using a data compression program called tElock.
The Sobig.F worm deactivated itself on September 10, 2003. On November 5 the same year, Microsoft announced that they will pay $250,000 for information leading to the arrest of the creator of the Sobig worm. To date, the perpetrator has not been caught.
In February 2009, Microsoft also gave the same prize for the information of Conficker Worm's author.
Read more about this topic: Sobig
Famous quotes containing the words technical and/or details:
“In effect, to follow, not to force the public inclination; to give a direction, a form, a technical dress, and a specific sanction, to the general sense of the community, is the true end of legislature.”
—Edmund Burke (1729–1797)
“Patience is a most necessary qualification for business; many a man would rather you heard his story than granted his request. One must seem to hear the unreasonable demands of the petulant, unmoved, and the tedious details of the dull, untired. That is the least price that a man must pay for a high station.”
—Philip Dormer Stanhope, 4th Earl Chesterfield (1694–1773)