Sobig fools around with e-mails

LONDON/SAN FRANCISCO: A new computer virus, feared to be the most potent ever, expanded its reach around the globe, sending e-mail networks crashing and frazzling technicians already over stretched by a plague of computer bugs.

In the United States, Internet and e-mail service providers were blocking the worm in record numbers, while others were getting through to an untold number of unprotected computer users. Those people were complaining of hundreds, and even thousands, of e-mails with the worm in their inboxes.

Internet service America Online said it blocked 23.2 million copies of the worm from reaching its customers and e-mail security provider Postini said it quarantined 3.5 million copies.

MessageLabs, a British-based Internet security firm, said one in 17 e-mails sent around the world since Monday had been affected by SoBig.F.

The SoBig.F virus, which first appeared on computing systems Monday, spreads when unsuspecting computer users open file attachments in e-mails that contain such familiar headings as "Thank you," "Re: Details" or "Re: approved."

Once the file is opened, SoBig.F resends itself to scores of e-mail addresses from the infected computer and signs the e-mail using a random name and address from the infected computer's address book, which makes tracing it back to the source extremely difficult.

SoBig.F also leaves a back-door program on the computer, which experts said may be used later to turn infected PCs into spam relay machines, as previous versions of Sob did.

The worm was bogging down e-mail systems, bouncing automatic replies back to people listed as the sender but who likely were not.

SOBIG, SO BAD

MessageLabs' chief information analyst, Paul Wood, said it was feared that SoBig.F could increase global e-mail traffic by as much as 60 percent, slowing the Internet to a crawl.

"It's unprecedented in our history. We stopped over one million (infections) in the first day," he said. "It's a pretty frightening statistic. And the next incarnation could be even worse."

Technicians have been scrambling for the past week to fend off the most concentrated onslaught ever seen from worms. A "worm" is a type of computer virus that can send itself over a network without being attached to another, "host," program.

The outbreak began 10 days ago with the so-called "Blaster," or "LovSan," worm which, by some estimates, infected more than 500,000 computers running Microsoft Corp.'s Windows software, the world's dominant operating system.

This week, the "Welchia" worm, also dubbed "Nachi," surfaced. It was designed to patch the hole in Windows that Blaster, and Welchia, use to infect a computer.

But Welchia clogs computer networks, slowing Internet connections and even knocking some systems offline. Its victims include the European engineering firm ABB, Air Canada and the U.S. Navy and Marine Corps.

On Thursday, experts reiterated their advice to computer users to shore up their machines with anti-virus software and to delete suspicious-looking e-mails, hoping that preventive medicine will stop this wave before the next round.

© Reuters