OT: support@microsoft.com email/.PIF attachments - VIRUS

[Confused]

For those that don't venture out of here, there are some emails floating around, mainly appearing to come from support@micorsoft.com that is actually a virus. There are also some reports of them coming from support@rr.com and other ISP's. They are also coming through as MANY other names/addresses, but they are all charactised by using a .PIF extension. DO NOT RUN ANY .PIF FILES

AT OS thread

The Register article (link taken from above thread)

Info from Symantec.

W32.Sobig.B@mm is a mass-mailing worm that sends itself to all the email addresses that it finds in the files with the following extensions:

• .wab
• .dbx
• .htm
• .html
• .eml
• .txt

Refer to the Technical Details section of this writeup for the characteristics of the email message.

The worm is also network aware. It enumerates the network resources and copies itself to the following folders on other computers to which it has access:

• Windows\All Users\Start Menu\Programs\StartUp
• Documents and Settings\All Users\Start Menu\Programs\Startup

NOTES:

• The worm deactivates on May 31, 2003, and therefore, the last day on which the worm will spread is May 30, 2003.
• Virus definitions dated prior May 19, 2003 may detect this threat as W32.HLLW.Mankx@mm.

Symantec Security Response has created a tool to remove W32.Sobig.B@mm. Click here to obtain the tool.

Also Known As: W32.HLLW.Mankx@mm, W32/Palyh@MM [McAfee], W32/Palyh-A [Sophos], I-Worm.Palyh [KAV], WORM_PALYH.A [Trend], Win32.Palyh.A [CA]
Type: Worm
Infection Length: 52,898 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me

When W32.Sobig.B@mm is executed, it performs the following actions:

1. Copies itself as %Windir%\msccn32.exe.

NOTE: %Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.

2. Creates the following files:

• %Windir%\hnks.ini
• %Windir%\msdbrr.ini

3. Adds the value:

"System Tray"="%Windir%\msccn32.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that W32.Sobig.B@mm runs when you start Windows.

4. If the operating system is Windows NT/2000/XP, then the worm will also add the value:

"System Tray"="%Windir%\msccn32.exe"

to the registry key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

5. Enumerates the Network Resources and copies itself to the following folders:

• Windows\All Users\Start Menu\Programs\StartUp
• Documents and Settings\All Users\Start Menu\Programs\Startup

6. Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in the aforementioned .ini files.

Email Routine Details
W32.Sobig.B@mm uses its own SMTP engine to email itself to all the contacts it finds in the files with the following file extensions:

• .wab
• .dbx
• .htm
• .html
• .eml
• .txt

technical details

The email message has the following characteristics:

From: support@microsoft.com

Subject: The subject line will be one of the following:

• Your details
• Approved (Ref: 38446-263)
• Re: Approved (Ref: 3394-65467)
• Your password
• Re: My details
• Screensaver
• Cool screensaver
• Re: Movie
• Re: My application

Message Body: All information is in the attached file.

Attachment: The attachment name will be one of the following:

• your_details.pif
• ref-394755.pif
• pproved.pif
• password.pif
• doc_details.pif
• screen_temp.pif
• screen_doc.pif
• movie28.pif
• application.pif

Symantec usually puts out their Live Update on Wednedays, but they had an early one, today because of this. Note the link to a removal tool in the above quote from their page.

 

[RaySun2Be]

Thanks for the heads up, Confused. I read about this last night. So far, haven't seen anything of it, which is a good thing.

 

[Confused]

I got 2 of these through in my inbox this morning, and thought "Hey, what's this...I haven't given this email address to Microsoft" and promptly deleted them. Then came here and saw this in OS, and thought "Phew, glad i didn't do anything with that!" 🙂


If my post can stop just 1 person getting the virus, then I'll be happy 🙂


Garry

 

[CADsortaGUY]

Originally posted by: Confused
I got 2 of these through in my inbox this morning, and thought "Hey, what's this...I haven't given this email address to Microsoft" and promptly deleted them. Then came here and saw this in OS, and thought "Phew, glad i didn't do anything with that!" 🙂


If my post can stop just 1 person getting the virus, then I'll be happy 🙂


Garry

Same here😛 Microsoft sending me stuff? Ummm....DELETE! 😛

CkG

 

[ProviaFan]

Originally posted by: CADkindaGUY
Same here😛 Microsoft sending me stuff? Ummm....DELETE! 😛

CkG

Yea, it's important to remember that MS doesn't send out stuff by email, so if you get one it's definitely a hoax.

 

[Wiz]

Right, just to clarify a little: MS sends out lots of news and information by email but not file attachments.

I too have seen a few of these over the pase couple days.

Stinking viruses & spammers, I sure wish they would all just go away. :|

 

[RaySun2Be]

Originally posted by: Wiz
Right, just to clarify a little: MS sends out lots of news and information by email but not file attachments.

I too have seen a few of these over the pase couple days.

Stinking viruses & spammers, I sure wish they would all just go away. :|

That's right. I get a Microsoft security alert newsletter, but it never has attachments, and it only goes to a specific email addy.

And I still haven't gotten any of those virus emails, which is a very good thing! 😀

 

[zodder]

I block all that stuff at the server. I have noticed an increase in the amount of .PIF files that have been coming in, though.

 

[Smoke]

You should have all opened up the attachment ... it contained some very neat stuff. 😛 😀


j/k

😉

 

[MoFunk]

Originally posted by: Smokeball
You should have all opened up the attachment ... it contained some very neat stuff. 😛 😀


j/k

😉

Thanks Greg, I took your advice. Fun stuff. 😉

 

[deerslayer]

Thanks for the heads up!

 

[Robor]

I got one of these in my work inbox on Monday. Strange thing is I *never* get spammed at my work address because I rarely give it out. The other strange thing is our Exchange A/V software didn't catch it. I even forwarded it on to a coworker to see if it would catch it but it let me forward it right on through. Wouldn't think it would allow a .pif file to come in. 😕

All these virus creaters just need to SABFD if you ask me. :disgust: :|

 

[Smoke]

The full story

😉