W32/Sobig.C@mm, a new variant of Sobig, has started spreading

W32/Sobig.C@mm, a new variant of Sobig, was discovered in the wild on 31 May 2003.

E-mail messages carrying W32/Sobig.C@mm have the following characteristics:

Subject line:
The subject line is randomly selected from this list:

Approved
Re: 45443-343556
Re: Application
Re: Approved
Re: Movie
Re: Submited (004756-3463)
Re: Your application

Attachment:
The attachment will have either a .SCR or a .PIF ending. The attachments name is randomly selected from the following list:

45443.pif
approved.pif
application.pif
document.pif
documents.pif
movie.pif
screensaver.scr
submited.pif

Message body:
The body of the message carrying W32/Sobig.C@mm is:

Please see the attached file

W32/Sobig.C@mm is detected with the latest versions of F-Prot Antivirus products using virus signature files created on 31 May 2003 or later.

Commtouch® is a leading developer of anti virus software and anti spam filtering services. Commtouch's anti virus computer software, F-PROT Antivirus, is available for a number of operating systems such as Windows, Linux, BSD, Solaris, and AIX as well as the Microsoft Exchange groupware.