# MA-051.052003: MyCERT Advisory - W32.Sobig@B MM Worm

**Date:** 27 May 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-051.052003  
**Advisory ID:** MA-051.052003

---

1.0 Description
#### 1.1 Overview
The W32.Sobig.B is an Internet worm and a mass mailing worm that sends itself to all the email addresses found in the Windows Address Book. The worm looks like it was sent by Microsoft ([[email protected]](/cdn-cgi/l/email-protection)). It was discovered on 18th May 2003 EST time. This worm has strong similarities to W32/Sobig@MM. It is written in MSVC and is packed with UPX. The worm propagates via email and over network shares. It has its own SMTP engine for constructing outgoing messages. The worm's file has a .PIF extension, with size of attachment 52,898 bytes .
When email is opened using this application (without a patch) it will execute itself.
The risk assessment by many anti-virus vendors, for this variant has been graded to a MEDIUM risk degree.
NOTE: Starting from the 4266 DATs (released 05/21/03), this virus has been renamed from W32/Palyh@MM to W32/Sobig.b@MM in order to correctly identify it as a new variant of W32/Sobig@MM.
#### 1.2 Systems Affected
Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
#### 1.3 Limitation
No limitations. It does not require the email receiver to open the attachment for it to execute.
#### 1.4 Aliases
W32.HLLW.Mankx@mm
W32/Palyh@MM [McAfee]
W32/Palyh-A [Sophos]
I-worm.Palyh [KAV]
WORM\_PALYH.A [Trend]
Win32.Palyh.A [CA]
#### 1.5 Payload
Payload is triggered on dates prior to 31st May 2003.
##### Payloads
1.5.1 Large scale e-mailing: send itself to email addresses found on an infected system .
### 2.0 Technical Matters
(Referred to Symantec and McAfee)
When W32.Sobig.B@mm is executed, it performs the following actions:
2.1 Copies itself as %Windir%\msccn32.exe.
> NOTE: %Windir% is a variable. The worm locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location.
2.2 Creates the following files:
> %Windir%\hnks.ini
> %Windir%\msdbrr.ini
2.3 Adds the value:
> "System Tray"="%Windir%\msccn32.exe"
to the registry key:
> HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft \Windows\CurrentVersion\Run
so that W32.Sobig.B@mm runs when you start Windows.
2.4 If the operating system is Windows NT/2000/XP, then the worm will also add the value:
> "System Tray"="%Windir%\msccn32.exe"
to the registry key:
> HKEY\_CURRENT\_USER\SOFTWARE\Microsoft \Windows\CurrentVersion\Run
2.5 Counts out the Network Resources and copies itself to the following folders:
> Windows\All Users\Start Menu\Programs\StartUp Documents and Settings\All Users\Start Menu\Programs\Startup
2.6 Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in the aforementioned .ini files.
W32.Sobig.B@mm is also network-aware. It counts out the network resources and copies itself to the following folders on other computers to which it has access:
> Windows\All Users\Start Menu\Programs\StartUp Documents and Settings\All Users\Start Menu\Programs\Startup
The worm contains a routine which retrieves and checks the system date/time. If the date matches 31st May 2003 (or later), the worm no longer propagates (it will successfully install itself on target machines however).
Target email addresses are extracted from files on the victim machine with the following extensions:
> WAB
> DBX
> HTM
> HTML
> EML
> TXT
The email message has the following characteristics:
> From: [[email protected]](/cdn-cgi/l/email-protection)
Subject: The subject line will be one of the following:
> Your details
> Approved (Ref: 38446-263)
> Re: Approved (Ref: 3394-65467)
> Your password
> Re: My details
> Screensaver
> Cool screensaver
> Re: Movie
> Re: My application
Message Body: All information is in the attached file.
Attachment: The attachment name will be one of the following:
> your\_details.pif
> ref-394755.pif
> approved.pif
> password.pif
> doc\_details.pif
> screen\_temp.pif
> screen\_doc.pif
> movie28.pif
> application.pif
NOTES:
The worm de-activates on May 31, 2003, and therefore, the last day on which the worm will spread is May 30, 2003. Virus definitions dated prior to May 19, 2003 may detect this threat as W32.HLLW.Mankx@mm.
### 3.0 Possible Steps
#### 3.1 Prevention
3.1.1 Remove or turn off any unneeded services. If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
3.1.2 Ensure up-to-date patches are installed (using MS01-020 to prevent emails from being able to automatically launch executable attachments), especially on computers that host public services such as HTTP, FTP, mail, and DNS services. Information and a patch for the vulnerability can be found at:
> http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
3.1.3 Apply filter on mail servers to detect and remove the worm based on:
> 3.1.3.1 File attachments with .PIF
>
> 3.1.3.2 File size 52,898 bytes
>
> 3.1.3.3 Virus signature by various Anti-virus vendors
3.1.4 Isolate infected computers quickly to prevent further compromises and restore relevant data from trusted media.
3.1.5 Do not to open attachments unless the attachment has been scanned for virus or malicious codes.
3.1.6 Do not execute software that is downloaded from the Internet unless it has been scanned for viruses or downloaded from trusted sources.
3.1.7 Upgrade to Internet Explorer 6
3.1.8 Practise safe email practices, pls refer at:
> [https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
> )
#### 3.2 Detection
Many antivirus with the latest virus definitions is able to detect the worm.To detect the virus, run an antivirus scan with the latest signature file on your system. Ensure the anti-virus is configured to scan ALL FILES.
#### 3.3 Removal
There are two ways to clean up the infected machine, the automatic and manual removal.
**3.3.1 Automatic Removal:**
> 3.3.1.1 Isolate the infected machine by disconnecting the machine from the network.
>
> 3.3.1.2 Close any sharing files/folder/directory. When sharing files/folder/directory, do not give full access (read and write).Settle for read only instead.
>
> 3.3.1.3 Download the tool to clean up the infected machine
>
> **Symantec:**
> http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.b.removal.tool.html
>
> **Trend Micro**
> http://www.trendmicro.com/download/tsc.asp
**3.3.2 Manual Removal: (Referred to Symantec)**
> 3.3.2.1 Isolate the infected machine by disconnecting the machine from the network.
>
> 3.3.2.2 Close any sharing of files/folder/directory. When sharing files/folder/directory, do not give full access (read and write).Settle for read only instead.
>
> 3.3.2.3 Restart pc in safe mode
>
> To restart Windows 95/98 in Safe Mode:
>
> - Restart the computer.
> - Press F8 until Microsoft Windows Startup Menu appears.
> - Select “safe mode”. Then the window starts in Safe Mode.
>
> 3.3.2.4 Scan with an anti-virus to detect and delete the files
>
> 1. Run your antivirus program and make sure that it is configured to scan all the files.
> 2. Scan the system
> 3. If any files are detected as infected with W32.Sobig.B@mm, click Delete.
>
> 3.3.2.5 Finding and deleting files
>
> Follow the instructions for your operating system:
>
> **Windows 95/98/Me/NT/2000**
>
> 1. Click Start, point to Find or Search, and then click Files or Folders.
> 2. Make sure that "Look in" is set to (C:) and that "Include subfolders" is checked.
> 3. In the "Named" or "Search for..." box, type, or copy and paste, the filenames:
>    > hnks.ini msdbrr.ini
> 4. Click Find Now or Search Now.
> 5. Delete the displayed files.
>
> **Windows XP**
>
> 1. Click Start, and then click Search.
> 2. Click All files and folders.
> 3. In the "All or part of the file name" box, type, or copy and paste, the filenames:
>    > hnks.ini msdbrr.ini
> 4. Verify that "Look in" is set to "Local Hard Drives" or to (C:).
> 5. Click "More advanced options."
> 6. Check "Search system folders."
> 7. Check "Search subfolders."
> 8. Click Search.
> 9. Delete the displayed files.
>
> 3.3.2.6. Deleting the values from the registry
>
> > CAUTION: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.
>
> 1. Click Start, and then click Run. (The Run dialog box appears.)
> 2. Type regedit
>    Then click OK. (The Registry Editor opens.)
> 3. Navigate to the key:
>
>    > HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run
> 4. In the right pane, delete the value:
>
>    > "System Tray"="%Windir%\msccn32.exe"
> 5. If the operating system is Windows NT/2000/XP, navigate to the key:
>
>    > HKEY\_CURRENT\_USER\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run
> 6. In the right pane, delete the value:
>
>    > "System Tray"="%Windir%\msccn32.exe"
> 7. Exit the Registry Editor.
>
> 3.3.2.7 Restart the computer.
>
> 3.3.2.8 Re-scan the machine to make sure the machine has been cleaned completely.
>
> If there is still file infected, delete the file. Please make sure you write down the file before delete if you want to reinstall the file later.
>
> 3.3.2.9 Re-connect the machine to the network.
>
> Take preventive measures by
>
> > practicing safe email practices. Please refer at:
> > [https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
> > )
### 4.0 More Information
More information on this worm can be obtained from the following sites:
4.1 Mcafee
http://vil.mcafee.com/dispVirus.asp?virus\_k=100307
4.2 Sophos:
http://www.sophos.com/virusinfo/analyses/w32palyha.html
4.3 Symantec:
http://www.symantec.com/avcenter/venc/ data/[[email protected]](/cdn-cgi/l/email-protection)
4.4 Trend Micro
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM\_SOBIG.B
4.5 F-Prot
http://www.f-prot.com/news/vir\_alert/sobig\_b.html