# why did the sobig virus spread so fast (or why are people so stupid) **URL:** \ **Category:** Factual Questions\ **Created:** [August 22, 2003, 11:43am UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895 "2003-08-22T11:43:23Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![DarrenS](https://avatars.discourse-cdn.com/v4/letter/d/977dab/32.png) [@DarrenS](https://boards.straightdope.com/u/DarrenS)\ **Post date:** [August 22, 2003, 4:08pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/21 "2003-08-22T16:08:30Z")
FTR - ZoneAlarm does have [functionality](http://zonealarm.com/store/content/company/aboutUs/pressroom/pressReleases/2000/mailsafe.jsp) to screen e-mails for viruses. May only apply to the “Pro”, i.e. non-free version though. ---
**Author:** ![The\_Tropical\_Warlord](https://avatars.discourse-cdn.com/v4/letter/t/7993a0/32.png) [@The\_Tropical\_Warlord](https://boards.straightdope.com/u/The_Tropical_Warlord)\ **Post date:** [August 22, 2003, 4:11pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/22 "2003-08-22T16:11:32Z")
I have received 47 such e-mails since Tuesday. Oddly enough, judging by several returned mail notices, I appear to be spreading the virus, despite: (i)Not opening any attachments (ii)Not using outlook express (iii)Being behind a firewall ---
**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\ **Post date:** [August 22, 2003, 4:29pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/23 "2003-08-22T16:29:44Z")
> [@](#): > > \*Originally posted by The Tropical Warlord \* > \*\*Oddly enough, judging by several returned mail notices, I appear to be spreading the virus, despite: > > (i)Not opening any attachments > (ii)Not using outlook express > (iii)Being behind a firewall \*\* The worm forges the From: address on emails it sends, so it’s likely that you are receiving returned mail notices for messages that were really sent from another machine. You can make sure you’re not infected by running [HouseCall](http://housecall.trendmicro.com) or the pandasoftware scanner **sailor** posted. ---
**Author:** ![CurtC](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@CurtC](https://boards.straightdope.com/u/CurtC)\ **Post date:** [August 22, 2003, 4:33pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/24 "2003-08-22T16:33:38Z")
Warlord, the Sobig worm spoofs the return address, so when computer A sends a worm message to computer B, it puts computer C’s return address on it. It gets C’s address from A’s address book, store of old e-mails, and/or browser cache. So the fact that people get the worm with your return e-mail address is no indication that you have it, but it is an indication that someone you both know has it. Also, items (ii) and (iii) on your list are of no help against Sobig. It doesn’t exploit a problem with OE, it exploits users who run unchecked attachments from any mail client. I guess a firewall could help if it notifies you _after_ you’ve been infected that something is trying to send e-mail with SMTP, but I’m not sure whether most firewalls do this - they’re more concerned with incoming traffic. What I always coach people to do is to not open any e-mail attachment, unless it’s one they know is safe such as .jpg, without first contacting the sender and asking whether that person actually intended to send you the attachment. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 22, 2003, 4:58pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/25 "2003-08-22T16:58:44Z")
> [@](#): > > \*Originally posted by viking \* > \*\*Allowing arbritrary code to open internet ports doesn’t qualify as a security hole in your book? \*\* The operating systems that I am familiar with all will allow code to open internet ports. I am not sure what your point is here. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [August 22, 2003, 5:11pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/26 "2003-08-22T17:11:35Z")
I do not understand very well why people warn (only or mostly) about not opening attachments from people “you don’t know”. Ahem. . . . As has been said, email sender’s address can easily be spoofed. And, even if a friend really sends you something it does not mean he is not unwittingly sending you something infected with a virus. I do not trust _anything_ which could carry a virus, no matter who sent it. Friends can be infected and not know it. I check and double check. It’s the only safe thing to do. ---
**Author:** ![wolf\_meister](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolf_meister/32/15202_2.png) [@wolf\_meister](https://boards.straightdope.com/u/wolf_meister)\ **Post date:** [August 22, 2003, 5:26pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/27 "2003-08-22T17:26:32Z")
**RealityChuck** How about Microsoft’s ‘brilliant’ idea to hide file extensions as the default choice ? Or we shouldn’t blame Microsoft for that either ? ---
**Author:** ![Elmer\_Snerd](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@Elmer\_Snerd](https://boards.straightdope.com/u/Elmer_Snerd)\ **Post date:** [August 22, 2003, 5:26pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/28 "2003-08-22T17:26:50Z")
> [@](#): > > _Originally posted by RealityChuck_ > \*\*Let’s get one thing straight: nothing about Sobig has anything to do with security holes in any Microsoft products. (Blaster is another matter.) You can’t blame Microsoft if you get infected with it. \*\* > [@](#): > > \*Originally posted by viking \* > \*\*Allowing arbritrary code to open internet ports doesn’t qualify as a security hole in your book? \*\* I think that the original point is that the Sobig-carrying attachment _must_ be manually opened by the recipient, regardless of what it does afterward. It does not autoexecute like [Klez](http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.gen@mm.html) due to an unpatched security flaw. ---
**Author:** ![viking](https://avatars.discourse-cdn.com/v4/letter/v/bc79bd/32.png) [@viking](https://boards.straightdope.com/u/viking)\ **Post date:** [August 22, 2003, 10:14pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/29 "2003-08-22T22:14:48Z")
> [@](#): > > \*Originally posted by gazpacho \* > \*\*The operating systems that I am familiar with all will allow code to open internet ports. I am not sure what your point is here. \*\* Code, yes. But unless I am drastically mistaken (which is always a strong possibility), to open a port and act as a deamon, code on unix would have to be run as a priviledged user (or administrator on the mac). So arbritrary code, no. Granted, on a desktop machine the user may well have root access, but they’ll still be prompted to authenticate if they want to install software that opens ports, no? ---
**Author:** ![Just\_Some\_Guy](https://avatars.discourse-cdn.com/v4/letter/j/ad7895/32.png) [@Just\_Some\_Guy](https://boards.straightdope.com/u/Just_Some_Guy)\ **Post date:** [August 22, 2003, 10:31pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/30 "2003-08-22T22:31:02Z")
Something that a lot of people don’t get is just how ingenious SoBig is on the annoyance factor. It’s essentially a replicating mass mailer; a high speep, particularly annoying one. A good DSL connection can send out over ten thousand messages containing the bug in an hour. And all of those are being sent to (and with faked from) name that’s culled from just about any file on their computer. Think about the scale of damage one infected computer can do and multiply that by millions. Each infection is no big deal by itself but the cumulative collateral damage they cause is astronomical. I can just look at the messages in this thread that mention how often they’re recieving it or getting responses that say they’re sending it by poorly thought out autoresponses. The volume of noise it’s generating is grinding many people’s e-mails to a halt. For a virus that Symantic has only rated as a level 3 threat it has the most far reaching, damaging consequences I’ve ever seen. ---
**Author:** ![SPOOFE](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@SPOOFE](https://boards.straightdope.com/u/SPOOFE)\ **Post date:** [August 23, 2003, 12:00am UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/31 "2003-08-23T00:00:59Z")
> [@](#): > > How about Microsoft’s ‘brilliant’ idea to hide file extensions as the default choice ? Or we shouldn’t blame Microsoft for that either ? Uh… and what does this have to do with anything? It’s not like they make it particularly difficult to change settings (and let’s face it… if you don’t go through your OS and customize the settings to your own preferences, you’re precisely the kind of person that would prefer to hide the file extensions). ---
**Author:** ![Ms2001](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ms2001/32/18463_2.png) [@Ms2001](https://boards.straightdope.com/u/Ms2001)\ **Post date:** [August 23, 2003, 12:23am UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/32 "2003-08-23T00:23:45Z")
> [@](#): > > \*Originally posted by viking \* > **Code, yes. But unless I am drastically mistaken (which is always a strong possibility), to open a port and act as a deamon, code on unix would have to be run as a priviledged user (or administrator on the mac). So arbritrary code, no.** Incorrect. Any program can start listening on a port, which is how it should be. Think of the common protocols that use incoming connections: FTP, AIM (direct connections), IRC (ident and file transfers), P2P file sharing, online games (to host a game). It wouldn’t make sense to require you to be logged on as root or Administrator to run those. You may be thinking of the “privileged” ports below 1024, which only root can use. That limitation is becoming outdated, though, now that everyone has his very own computer. Even if Windows only allowed Administrator to use ports below 1024, the worm could just listen on port 1995 instead of 995. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [August 23, 2003, 2:09pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/33 "2003-08-23T14:09:30Z")
> [@](#): > > \*Originally posted by CurtC \* > Warlord, the Sobig worm spoofs the return address, so when computer A sends a worm message to computer B, it puts computer C’s return address on it. It gets C’s address from A’s address book, store of old e-mails, and/or browser cache. So the fact that people get the worm with your return e-mail address is no indication that you have it, but it is an indication that someone you both know has it. Absolutely. But what puzzles me is that the anti-virus scanners installed at many ISPs don’t seem to know this. So I get a dozen bounced messages a day telling me that they don’t accept mail with certain kinds of attachments. Some of the boiler-plate text is even insulting. _But I didn’t send it, someone else did and used my return address!_ This just adds to the problem, since the scanner at my ISP lets these through just fine. So for every sobig email generated which gets blocked, one additional message gets generated by the scanner in its place. Someone needs to get a clue. And **Sailor** , I echo your sentiments about not using a virus scanner as part of a PC’s system. I’m smart and hip enough to recognize most of the common virus sigs – at 55/hour, the sobig.f was pretty obvious – I have file extensions showing, PIF & SCR execution turned off, etc., etc. and have never yet been infected. And Norton & MacAfee interfere terribly with the computer functions I want to use and I don’t need one more crap piece of software mucking up my system. I sometimes run a full system scan using the free tool at [antivirus.com](http://antivirus.com), and the only things it finds are files that I deliberately save as “bait” in a special folder for viruses. But I find it difficult to recommend to Average Joe to go bareback without a virus scanner in place. There’s no way AJ can absorb my (or your) knowledge and keep up with the latest trends, so I feel they must rely on an antivirus package and keep it up to date. ---
**Author:** ![handy](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@handy](https://boards.straightdope.com/u/handy)\ **Post date:** [August 23, 2003, 2:39pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/34 "2003-08-23T14:39:42Z")
I get it alot these days, but they come as PIF files, which my computer sees as MSDOS prompts & my scanner won’t scan MSDOS prompts… " why are people on unpatched M$ systems still opening unrequested, unexplained file attachments, particularly those with questionable file extensions?" Wouldn’t it be more logical to wonder why the richest person in the world can’t make software that’s secure? I have email software that’s not affected by worms. ---
**Author:** ![Hodge](https://avatars.discourse-cdn.com/v4/letter/h/5f9b8f/32.png) [@Hodge](https://boards.straightdope.com/u/Hodge)\ **Post date:** [August 23, 2003, 3:37pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/35 "2003-08-23T15:37:34Z")
> [@](#): > > \*Originally posted by sailor \* > \*\*With any of the free, online antivirus scans like [http://www.pandasoftware.com/activescan/com/](http://www.pandasoftware.com/activescan/com/) > Free, allways up to date, and doe not interfere with the running of your computer. I run that once in a while just to make sure I am clean. \*\* > [@](#): > > \*Originally posted by Musicat \* > **I sometimes run a full system scan using the free tool at [antivirus.com](http://antivirus.com), and the only things it finds are files that I deliberately save as “bait” in a special folder for viruses.** This is all well and good if your internet connection is up and running. However, you’re screwed if a virus zaps your connection and you’re left with no means of cleaning it. As an added layer of protection to web-based virus scans, allow me to recommend the [F-Prot Antivirus](http://www.f-prot.com/download/home_user/) for DOS. You can make a DOS boot-disk to thoroughly scan your system without running any windows services at all. I make regular, updated boot disks and run regular overnight scans in DOS just to be on the safe side. ---
**Author:** ![matt\_mcl](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@matt\_mcl](https://boards.straightdope.com/u/matt_mcl)\ **Post date:** [August 23, 2003, 3:48pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/36 "2003-08-23T15:48:02Z")
> [@](#): > > So the fact that people get the worm with your return e-mail address is no indication that you have it, but it is an indication that someone you both know has it. Oh really? This is a relief (for myself I mean, not for whatever poor sucker has this). I have the vaguest notion of what a firewall is, but I certainly never open suspicious attachments of any kind. Also I ran two different virus checks and both came out negative. So I was a little puzzled as to why I kept getting about eight or nine “WARNING, YOU HAVE A VIRUS” or “Returned mail: Forbidden file type” messages from people. ---
**Author:** ![yawndave](https://avatars.discourse-cdn.com/v4/letter/y/43a26b/32.png) [@yawndave](https://boards.straightdope.com/u/yawndave)\ **Post date:** [August 23, 2003, 4:42pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/37 "2003-08-23T16:42:09Z")
I have been getting emails from “Mail Administrator” with the subject “Mail System Error-Returned Mail”. Is this due to the virus?There is an attachment (unopened!), and the message says that it was not able to deliver an outgoing email. However, I never sent an email to the address noted. Any ideas out there? I’m using a computer at the public library when this happens. ---
**Author:** ![amarinth](https://avatars.discourse-cdn.com/v4/letter/a/3be4f8/32.png) [@amarinth](https://boards.straightdope.com/u/amarinth)\ **Post date:** [August 23, 2003, 5:01pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/38 "2003-08-23T17:01:03Z")
I only had it sent to me once - (though it kept going through one mailing list that I’m on about 30-something times, that list strips attachments.) Strangely, it was from someone I had earlier sent an email to, requesting further explanation and information about something. I _was_ expecting a reply, one labeled “details” wasn’t entirely out of the question. I was at work, so I needed to use Outlook. The virus scanner mandated by work (McAfee - which is what took down my last home computer, but it did take the time to run everything slowly while failing to catch any viruses.) didn’t catch it. Had I been slightly more absent minded, I would have gotten it. I’m sure there’s a lot of people out there like me who were distracted enough to get it. I’m sure there are also those who are oblivious to the whole idea of a virus. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 23, 2003, 5:01pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/39 "2003-08-23T17:01:06Z")
> [@](#): > > Wouldn’t it be more logical to wonder why the richest person in the world can’t make software that’s secure? I have email software that’s not affected by worms. I still do not see where microsoft is at fault with this particular worm. A computer that does not execute programs that the user tells it to execute is not particularly useful. I really do not look forward to a time when these secure computing initiatives being put foreward by various companies take hold. Computers will loose a lot of their fun and usefulness if the only programs that can be executed are programs that have been signed by somebody like microsoft or verisign. ---
**Author:** ![FyreFiend](https://avatars.discourse-cdn.com/v4/letter/f/919ad9/32.png) [@FyreFiend](https://boards.straightdope.com/u/FyreFiend)\ **Post date:** [August 23, 2003, 5:34pm UTC](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895/40 "2003-08-23T17:34:38Z")
> [@](#): > > \*Originally posted by gazpacho \* > \*\*The operating systems that I am familiar with all will allow code to open internet ports. I am not sure what your point is here. \*\* Not the original poster but on Unixlike OS only root (the admin) can open ports under 1024. Not that that would have stopped something like this. Any user can open 1025 and above. I am still amazed that people running windows will open any .doc, .exe, .pif, .com, .scr, etc files without scanning them first. [Previous page](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895.md?page=1) [Next page](https://boards.straightdope.com/t/why-did-the-sobig-virus-spread-so-fast-or-why-are-people-so-stupid/196895.md?page=3)