Archive for Tuesday, August 19, 2003

Sobig f. worm slowing e-mail at KU

August 19, 2003


Kansas University posted a warning Tuesday afternoon on its Web site cautioning about a new version of the Sobig worm -- W32.Sobig.F --which is infecting computers around the world.

"The problem with the virus is it's a little more difficult for a user to detect because it has several different subject lines and attachment names," said Jeree Catlin, KU associate director for academic computing services.

The KU Web site lists the subject lines and the attachments to beware of, she said.

Catlin said KU has blocked the worm with virus protection on its Exchange e-mail system.

The only affect thus far is that the thousands of e-mails trying to flood the sytem is causing a slowdown in e-mail services on the Exchange, Catlin said.

Sobig.F first appeared Tuesday and spread rapidly around the globe, including the in-boxes at KU.

Vunerable operatings systems are Windows 95, 98, NT, ME, 2000 and XP.

According to KU, if you receive the Sobig.F-infected e-mail, the address on the "from" or "reply to" lines is probably not the one that sent it to you.

"When Sobig.F infects a computer, it gathers all the e-mail addresses it can find on that computer and secretly sends infected messages to all but one of those addresses," the warning says.

"Sobig places that one, randomly chosen, address in the FROM line of all those outgoing messages so that it will be difficult to determine where the messages really are from, and some innocent person will be wrongly accused."

For more on this story and to see how the worm has affected other large computer systems in Lawrence, see Wednesday's Journal-World.

Commenting has been disabled for this item.