#Worm virus download software#
#Worm virus download download#
#Worm virus download windows#

Most antivirus software vendors have updated their software to be able to identify Sobig. I cannot explain it at all,' Hypponen said.

Recent vintage worms like Lirva and Bugbear often take advantage of a Microsoft Internet Explorer and Outlook vulnerability known as the 'IFrame exploit' that allows e-mail attachments to be launched without any user interaction. In addition, the Sobig e-mail messages use one of only a small number of subjects, unlike recent worms, which use a larger list of possible subjects and attachment names or generate their own at random, according to Hypponen.ДЇinally, Sobig requires e-mail recipients to double-click on the attachment containing the worm.

The success of Sobig since it first appeared surprised Hypponen, who said Sobig is a comparatively simple worm that lacks many of the sophisticated features that allow the new generation of viruses to spread.ДЇor example, Sobig always arrives in e-mail messages from the same sender, unlike recent successful worms such as Bugbear or Lirva, which generated their own sender addresses, swapped in trusted sender addresses from sources such as antivirus vendors or selected them at random from a long list. On Monday, Symantec Corp.'s Security Response upgraded Sobig from a Category 2 to a 'moderate' Category 3 threat. Other antivirus companies upgraded their threat ratings for Sobig, as well. As of Tuesday, F-Secure gave the worm a Level 2 ranking, indicating 'large infections' and putting it in a category with well-known predecessors such as the Klez worm. In recent days, however, it has spread more rapidly.

The worm first came to the attention of antivirus companies last Thursday and began spreading slowly, Hypponen said. Yahoo wasn't immediately available to comment on the Sobig worm. GeoCities has been notified about the page by F-Secure as well as the CERT Coordination Center in Pittsburgh, according to Hypponen.

#Worm virus download download#

The GeoCities Web page used by Sobig was modified recently to instruct the worm to download a Trojan program known as Backdoor.Delf that gives the virus writer and others control of infected machines, according to Mikko Hypponen, manager of antivirus research at F-Secure. Sobig also searches for any shared folders on networks that the infected machine may have access to and places a copy of itself in any network folder it can access.ДЄlthough the new worm doesn't appear to steal sensitive information from the computers it infects, F-Secure said antivirus companies warned that the worm connects to a Web site hosted by Yahoo Inc.'s GeoCities, from which it tries to download and execute other files. Those addresses are used to send out more copies of itself. Once it has infected a machine, the worm searches for e-mail addresses in a variety of text files on the computer's hard drive.

#Worm virus download windows#

When opened, the worm places a copy of itself into the Windows folder on the infected machine, creates a process to run the worm program and modifies the Windows registry so that the worm program will be launched whenever Windows is started.