FBI warns of virus on fraudulently addressed e-mail

Starting Nov. 21, 2005, field offices of the Federal Bureau of Investigation across the country have been swamped with complaint calls from recipients of a fraudulently addressed e-mail within a two-hour period.

According to Charles L. Goodwin, FBI Special Agent in Charge in Honolulu, Hawaii, the e-mail was purporting to be from the FBI from the following fake email addresses department@fbi.gov, mail@fbi.gov, etc. The emails contained an attachment named “question list.zip.” It appeared from a preliminary investigation that the attachment contained a malicious code named W32/Sober.gen@MM.

McAfee anti-virus software detects the malware as the W32/sober.gen@mm virus. The “.gen” extension means that the anti-virus software recognized this as a variant in the W32/sober virus family, but cannot pinpoint the specific variant. This is probably because this is a new, yet uncharacterized, variant.

Preliminary analysis shows that on execution the malware carries out the following actions:

– Produce pop-window that appears to be an error message containing the text “Winzip Self Extractor-Error in packed header”.

– Opens and reads files on the hard drive. This is consistent with the e-mail harvesting behavior of the W32/Sober viruses.

– Sends multiple e-mail messages from the affected system to e-mail addresses likely harvested from the hard drive. The e-mail messages contain a copy of the malware in the form of a file attachment.

As a result of this malware, McAfee recently issued an update to their W32/Sober.gen@mm description at http://vil.nai.com/vil/content/v_102139.htm Symantec (Norton) is now calling this virus W32.Sober.X@mm.

Goodwin said that these e-mails did not come from the FBI. “Recipients of this or similar solicitations should know that the FBI does not engage in the practice of sending unsolicited e-mails to the public in this matter. Opening e-mail attachments from an unknown sender is a risky and dangerous endeavor as such attachments frequently contain viruses that can infect the recipient’s computer,” he said in a statement.

The FBI strongly encourages computer users not to open such attachments, install current windows updates, and install/update anti-virus software.

“The FBI takes this matter seriously and is investigating. Users are instructed to delete the e-mail without opening it,” Goodwin added. (PR)