Sobig creator may create an army of zombie computers

The culprit behind the fast-spreading Sobig.F virus is expected to try again in coming weeks to create a vast network of zombie computers to carry out Internet attacks, security experts warned on Saturday.

"He wants to build up a [robot] net by creating zombie machines he can control," said Vincent Weafer, senior director of Symantec Corp's Security Response center.

An attack that had been set for Friday at noon California time was thwarted by government and security industry experts before it could take control of some 100,000 infected computers and possibly cripple the Internet.

Sobig.F released last Monday on a sex-oriented Internet discussion group, infecting computers when users clicked on what appeared to be nude pictures, experts from several security companies who had seen the site said.

Prior of Sobig.F -- the F is the sixth variation of the Sobig virus that first began appearing in January -- appeared to test different means of self-replication, with each of the six versions becoming more sophisticated, Weafer said.

"There has been a sequence of different worms to create a greater goal -- dynamic [robots] that can update themselves," Weafer said.

By weekend, the infection rate of Sobig.F, which security firms call one of the fastest growing e-mail viruses ever, appeared to slow. Symantec said it was receiving 25 percent fewer copies of the virus per day on Saturday than a day or two earlier.

Infected now total 145,264 worldwide, according to rival security software vendor Trend Micro's global virus map. The majority of the potential zombie machines were in North America, with 87,347, another 52,841 in Europe and 5,842 in Asia and lesser numbers on other continents.

The virus spreads when unsuspecting computer users open file attachments in e-mails that contain familiar headings like "Thank You!," and "Re: Details."

Once the file is opened, Sobig.F resends itself to e-mail addresses from the infected computer and signs the e-mail using a random name and address from the computer's address book.

The US FBI served a subpoena on a Phoenix, Arizona-based ISP, Easynews.com, on Friday, the company confirmed. The FBI and Department of Homeland Security declined to comment.

The Washington Post reported that officials believe someone using an account from Easynews released Sobig.F and that the account was opened using a stolen credit card minutes before the virus was released on Monday.