# New email worm/virus (big@boss.com) **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [March 7, 2003, 12:34am UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619 "2003-03-07T00:34:47Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\ **Post date:** [March 7, 2003, 12:34am UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/1 "2003-03-07T00:34:47Z")
Okay kids, there’s a relatively new worm floating around and I’ve seen at least three people get it in the last 24 hour period, so heads up. (I did a search and **Tuckerfan** started a [thread about it](http://boards.straightdope.com/sdmb/showthread.php?s=&threadid=155758&highlight=SOBIG) when it showed up in his in-box, but that was a coupla months ago, when it was only two days old, and I don’t think many people got to see it. Since it seems to be gathering momentum, I thought it warranted a new thread, and one with “[big@boss.com](mailto:big@boss.com)” in the thread title.) It’s called “sobig” and it’s a pretty standard worm with a trojan spoojed onto it. Here is [Symantic’s description.](http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.a@mm.html) [quote] The email message has the following characteristics: From: [big@boss.com](mailto:big@boss.com) Subject: The subject will be one of these:[ul][li]Re: Movies[_]Re: Sample[_]Re: Document[_]Re: Here is that sample[/ul][/li] Attachment: The attachment will be one of these:[ul][li]Movie\_0074.mpeg.pif[_]Document003.pif[_]Untitled1.pif[_]Sample.pif[/ul][/li] Before W32.Sobig.A@mm sends the messages, it sends a message to an address at [pagers.icq.com](http://pagers.icq.com). The worm also attempts to copy itself to the following folders on all the open network shares:[ul][li]\Windows\All Users\Start Menu\Programs\StartUpDocuments and Settings\All Users\Start Menu\Programs\Startup[/ul]Note: Symantec Security Response has received reports of W32.Sobig.A@mm downloading and installing the Backdoor Trojan, Backdoor.Lala.[/li][/quote] In case you have opened the attachment, Symantec has provided a [free removal tool](http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.a@mm.removal.tool.html) to clean your computer. It practically goes without saying that only folks using any of the various flavours of Windows need be concerned about this-- Mac & Linux users can continue to feel smug and secure. Oh, and I guess Windows users who don’t open e-mail attachments from strangers based on the vague hope that they might contain p.orn are okay, too. ---
**Author:** ![TeleTronOne](https://avatars.discourse-cdn.com/v4/letter/t/4af34b/32.png) [@TeleTronOne](https://boards.straightdope.com/u/TeleTronOne)\ **Post date:** [March 7, 2003, 1:29am UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/2 "2003-03-07T01:29:26Z")
Am I the only one who is dissapointed at these modern ‘virii’? I mean, really - they suck! I doubt the people who ‘write’ these things even know what “40 hex” is. Pathetic, I tell you, just pathetic. Back in the good ol’ days it was almost exciting to get a virus infection, nowadays it’s just stupid. I mean, come on, emailing somebody a pif file? How lame. ---
**Author:** ![Caught\_Work](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@Caught\_Work](https://boards.straightdope.com/u/Caught_Work)\ **Post date:** [March 7, 2003, 2:41am UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/3 "2003-03-07T02:41:42Z")
Is 40 hex a ---
**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\ **Post date:** [March 7, 2003, 3:44am UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/4 "2003-03-07T03:44:59Z")
> [@](#): > > I mean, come on, emailing somebody a pif file? How lame. I’m with you there. It’s one tiny step away from using a .vir extension. “Oh, look, it’s a virus!” We just have to convince our friends in Redmond to work it into future versions of their fine OS’s. “This is a virus extension. You need to make Windows hide it by default but treat the file as an executable.” Why not? ---
**Author:** ![yosemite](https://avatars.discourse-cdn.com/v4/letter/y/3ab097/32.png) [@yosemite](https://boards.straightdope.com/u/yosemite)\ **Post date:** [March 7, 2003, 7:16am UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/5 "2003-03-07T07:16:38Z")
> [@](#): > > Larry Mudd wrote: > > Mac & Linux users can continue to feel smug and secure. This is me, feeling smug and secure on my OS X machine. 🙂 And yeah, I’ve noticed a LOT of these “bigboss” emails coming in. Didn’t think much of them, other than they are an irritant. However, I do have a PC running Windows XP, and occasionally I pick email up on it. (I keep my Mac as my primary email machine to avoid viruses.) I have Norton Virus on the PC, and it has picked up several viruses already. ---
**Author:** ![Ethilrist](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ethilrist/32/4604_2.png) [@Ethilrist](https://boards.straightdope.com/u/Ethilrist)\ **Post date:** [March 7, 2003, 2:03pm UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/6 "2003-03-07T14:03:18Z")
> [@](#): > > \*Originally posted by Caught@Work \* > \*\*Is 40 hex a \*\* :eek: They got Caught@Work ! I mean, Caught@Work got it, not some nebulous group of people were caught. At work. ---
**Author:** ![garius](https://avatars.discourse-cdn.com/v4/letter/g/e19b73/32.png) [@garius](https://boards.straightdope.com/u/garius)\ **Post date:** [March 7, 2003, 2:25pm UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/7 "2003-03-07T14:25:01Z")
> [@](#): > > \*Originally posted by Larry Mudd \* > **"This is a virus extension. You need to make Windows hide it by default but treat the file as an executable."** Nah - it would automatically default to opening in **Microsoft Virus Runner** which they’d (illegally) batch with XP. The worst part is that it would be a hastily thrown together sub-standard program and you’d have to hunt for bloody hours to change the preferences if you wanted .virs to open in anything else. ---
**Author:** ![TeleTronOne](https://avatars.discourse-cdn.com/v4/letter/t/4af34b/32.png) [@TeleTronOne](https://boards.straightdope.com/u/TeleTronOne)\ **Post date:** [March 7, 2003, 2:26pm UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/8 "2003-03-07T14:26:32Z")
> [@](#): > > \*Originally posted by Ethilrist \* > \*\*:eek: > They got Caught@Work ! > > I mean, Caught@Work got it, not some nebulous group of people were caught. At work. \*\* I guess maybe he DID know 🙂 I suspect that the rest of the post would have looked something like this had he been allowed to finish: _Is 40 hex a great black beast of AAAAaaaaaggghhhh…_ (didn’t Joseph of Aramathea know what 40hex was?) But I guess he didn’t feel like typing out “AAAAaaaaaggghhhh…” I’d nominate myself for the most times I’ve inserted a random python reference into a completely unrelated thread in the past week, except I think I’d lose big-time in this crowd 🙂 But getting [somewhat] back on topic, But I think the .vir extension is a good idea. I think if anything else it would cut down on the amount of “VIRUS WARNING!” emails that get sent out, since you could just right-click the file and see that it’s a “Virus File”. I also think outlook should be renamed to “Microsoft Field Incubation Lab for Virii and Worms” or… umm… MFILVW for short. That wasn’t funny at all. If I think of a more clever acronym, I’ll come back (when come back bring virii?). ARGH that was terrible, what is with me today, I think I need more coffee. I’m sorry for wasting bandwidth. ---
**Author:** ![garius](https://avatars.discourse-cdn.com/v4/letter/g/e19b73/32.png) [@garius](https://boards.straightdope.com/u/garius)\ **Post date:** [March 7, 2003, 2:55pm UTC](https://boards.straightdope.com/t/new-email-worm-virus-big-boss-com/159619/9 "2003-03-07T14:55:55Z")
I can just imagine the pop-up helpful paperclip: **You have just downloaded a virus! Would you like to:** 1. Infect your own computer 2. Infect your friends’ computers 3. Look for similar viruses on MSN