Windows XP/2000/NT/ME/98/95

Sobig.F is a worm that spreads via e-mail and across shared network drives.

When Sobig.F spreads via e-mail, it reaches the computer in a message of variable characteristics and an attached file that almost always has a PIF extension. When it spreads across shared network drives, Sobig.F attempts to copy itself to those drives where it has gained access to.

Sobig.F sends UDP packets to the port 8998 of certain IP addresses, which answer with a web page address that the worm will access to download a file. It then opens ports 995 through 999 on the affected computer, and waits for control commands to be received.

Sobig.F is easy to recognize when it spreads via e-mail, as it reaches the computer in a message with the following characteristics:

• Subject:
  It can be one of the following:
  Re: Thank you
  Thank you!
  Your details
  Re: Details
  Re: Re: My details
  Re: Approved
  Re: Your application
  Re: Wicked screensaver
  Re: That movie
• Attachments:
  It can be one of the following:
  YOUR_DOCUMENT.PIF
  DOCUMENT_ALL.PIF  
  THANK_YOU.PIF  
  YOUR_DETAILS.PIF   
  DETAILS.PIF
  DOCUMENT_9446.PIF  
  APPLICATION.PIF
  WICKED_SCR.SCR
  MOVIE0045.PIF