Increased Junk Mail from Email Spoofers Sending Sobig Worm

Many of us are suffering from an increased number of spam or junk mail. The email address in the From is not the sender. The sender spoofed or used another person's email address to send us this email. But this isn't just spam. There is a bad worm attached called the Sobig worm. It is a variation of an earlier worm that was spread.

How did they get your email address? Your email address may be saved in someone's address book, your web address is stored in the Internet history or anywhere that your email address is stored on the computer or the Internet on an infected computer. Since you email address is now available to spammers, you can change your email address. But it is only a matter of time before they get the new one. If someone uses it, it is available.

What should you do? You should check your email through webmail to delete any junk mail with attachments that end in .src, .pif, .exe, .bat or anything that you did not expect. If you need to send a Word document or other files, you may want to zip the files and be sure to warn the recipient that you are sending an attachment. Those who use Outlook, Outlook Express or another email client can do so AFTER deleting suspicious email.

Check your email through webmail first, so you do not download the files to your computer. Your ISP should have a web mail like mine at webmail.rcn.com to check my personal email. If you have a paid domain name, you should have an email account that can be accessed through your web host webmail. My web host is PowWeb and my webmail can be accessed at webmail.powweb.com. That is where I type my email address and my password. If your mail account does NOT have webmail support, you can try web2mail.com, though they may be busy with this worm on the loose.

Your antivirus software should be up to date. To see if your computer is infected, Click Start button | Find (or Start button | Find | For Files and Folders) and look for a file called WINPPR32.EXE . If you find that file, your computer is infected. If using Norton Antivirus, get Symantec's Sobig removal tool and follow the directions exactly. If using McAfee, get the McAfee antivirus Sobig removal tool and follow the instructions there.

The subjects lines include Re: Details, Re: Approved, Re: My details, Re: Thank you!, Re: That movie, Re: Wicked screensaver, Re: Your application, Thank you!, Your details and similar subjects. The attachments include your_document.pif, thank_you.pif, your_details.pif, application.pif, wicked_scr.scr, movie0045.pif and related attachments. Never download or open an attachment without scanning with your antivirus. If you don't expect or recognize it, delete it.

Okay, Kim Davis and all of you who requested this info. My previous article about spoofing simply addressed spam without attachments. Tracing the original sender of these emails is trickier. It is simply quicker to delete the email.

Yvette Kuhns, Power Pages Web Design, August 19, 2003

Printer Friendy Version. If this article helped you, please donate any amount via PayPal. Thank you!

If you have any questions or helpful hints to share, please email me.

Please view our list of past articles for more useful information.