W32/Sobig.C@mm, a new variant of Sobig, has started spreading
W32/Sobig.C@mm, a new variant of Sobig, was discovered in the wild on 31 May 2003.
E-mail messages carrying W32/Sobig.C@mm have the following characteristics:
The subject line is randomly selected from this list:
- Re: 45443-343556
- Re: Application
- Re: Approved
- Re: Movie
- Re: Submited (004756-3463)
- Re: Your application
The attachment will have either a .SCR or a .PIF ending. The attachments name is randomly selected from the following list:
The body of the message carrying W32/Sobig.C@mm is:
Please see the attached file
W32/Sobig.C@mm is detected with the latest versions of F-Prot Antivirus products using virus signature files created on 31 May 2003 or later.