Mansfield University Home PageThe SoBig.F Virus began its run into the wild around August 18, 2003. The virus detection scanners on our staff faculty mail server "wheat" immediately stopped the passing of this virus to campus mail accounts. The virus protection on the student server "hedwig" was updated shortly after to also stop the virus from passing to student accounts. As a result, infection from this virus on campus has been minimal, however as a result of the after effects of the virus, CT is still receiving questions regarding the SoBig.F virus. Here are some FAQ's.
- "I keep getting messages saying that a message I sent was blocked because it had a virus, but I don't remember sending it. Do I have a virus?"
- I keep getting "undeliverable address" messages, and I never sent a message to that person.
- "I am getting messages asking me to look at an attachment, but there is none."
The SoBig.F virus "spoofs" email addresses, tricking the account receiving the message into believing it came from someone they might know. The virus picks up addresses from the infected machine's address book and mail messages. As a result of "spoofing" there are several outcomes that occur, causing "side effects" and a nuisance to users. Messages that appear to come from you will be sent to someone you may or may not know. If the mail server of the destination address uses virus scanning, it will pick up the virus, and thinking the virus came from your address (which it actually did not), a message is sent back to your address. In addition, if a spoofed message is sent from "you" to an address that no longer exists, you will receive a notification message from a "Postmaster" informing you the address no longer exists.
Unfortunately, those messages are legitimate email messages, and since we receive them from hundreds if not thousands of sources, they are impossible to block. In addition, you may receive messages that are actually the virus message with the attachment stripped off. Some ISPs and company mail servers and virus protectors automatically strip off infected attachments. That is what is happening in those cases - the infected attachment is stripped off, and as it passes through Mansfield mail server, it checks as "Clean" since the offending attachment is no longer there. Once again, delete the file.
- In Outlook Express I have a message that the "File Attachment may contain a virus" and I am unable to open the attachments! Should I alert the sender?
By default, Outlook Express automatically disallows access to attachment. It is not doing any file scanning to come to that conclusion, it just does that by default. To disable the feature in Outlook Express, go to "Tools", "Options", then the "Security" tab. Uncheck the box next to "Do not allow me to open or save attachments that may contain a virus.".