New worm variant disguised as e-mail from Gates

A potent new variety of the Sobig e-mail virus is spreading on the Internet, according to warnings from a number of leading antivirus companies.

The new virus, known as Sobig.C, was first detected on Saturday and is a variant of the original Sobig virus, which appeared in January 2003, according to a statement by Helsinki, Finland, security company F-Secure Corp.

Like the original Sobig virus, Sobig.C is a mass-mailing worm that spreads copies of itself through e-mail messages with attached files that contain the virus code.

Sobig.C arrives in e-mail messages that use a variety of subject lines such as "Re: Screensaver," "Re: Movie" and "Re: Your Application." The names of the attachment containing the virus also vary and include "screensaver.scr," "approved.pif" and "movie.pif," F-Secure said.

Once opened, the attachment copies the virus to the Windows folder on the infected machine and alters the machine's Microsoft Corp. Windows registry to make sure that the virus is started along with the operating system.

The worm scans infected machines for e-mail addresses stored in a variety of files including the Windows address book and on saved Web pages. Sobig.C saves the addresses it finds in a separate file, then targets those addresses with e-mail messages containing the virus.

Like its predecessor, Sobig.C is also capable of detecting and copying itself to vulnerable shared folders on a local area network, according to an alert by antivirus company Sophos PLC.

However, unlike the earlier worm, Sobig.C is capable of faking the sender's address as well, inserting e-mail addresses it finds on the host machine in the "From" line of messages containing the virus.

Messages containing the original Sobig worm used only one address on the From line: "," according to an alert posted on the Web site of McAfee Security, a business unit of Network Associates Inc.

That means messages containing the Sobig.C virus might appear to come from people the targeted user knows. In addition, receiving an infected e-mail from an address doesn't automatically mean that the sender's machine has been infected, F-Secure said.

Among the e-mail addresses spoofed by Sobig.C is "," the address for Microsoft Chairman and Chief Software Architect Bill Gates.

The new virus is just the latest Sobig variant to spread, in part, by using the name of the Redmond, Washington, company.

In May, another variant, Sobig.B, also known as "Palyh," infected machines worldwide by disguising itself as a message from Microsoft's support organization.

Most antivirus companies provided updated virus definitions to detect Sobig.C on Sunday and encouraged their customers to update their antivirus software as soon as possible.

Instructions for detecting the new virus were also posted on leading antivirus sites, as were tools for removing Sobig.C from infected machines.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Paul Roberts

IDG News Service
Show Comments

Brand Post

Bitdefender 2019

Taking cybersecurity to the highest level and order now for a special discount on the world’s most awarded and trusted cybersecurity. Be aware without a care!

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?