W32/Sobig.E@mm the second most stopped virus by F-Prot AVES
This latest variant was found in the wild on the 25th of June 2003.
It has gained wide distribution in less that 24 hours, and is now the second most frequently caught virus by F-Prot AVES
In the same way as its predecessors it spreads both via infected e-mail attachments and through open network shares.
Messages bearing the virus have the following characteristics:From address. This address is made up by W32/Sobig.E@mm and is not a valid e-mail address.
Subject: The Subject is randomly selected from the following list contained inside the virus:
Re: Re: Application ref 003644
Re: Re: Document
Attachment: An attachment bearing W32/Sobig.E@mm will be called on of these names:
document.zip (contains document.pif)
movie.zip (contains Movie.pif)
screensaver.zip (contains sky.world.scr)
your details.zip (contains details.pif)
Much like it predecessors W32/Sobig.E@mm has a built in end date, after which it will no longer distribute itself. This variant's end date is 14th of July.
W32/Sogbig.E@mm is detected with the current versions of F-Prot Antivirus using virus signature files dated 25 June 2003 or later.