SoBig.F

[ZWarrior]

------------------------------------------------------------
          ** VIRUS ADVISORY - W32/Sobig.f@MM **  
------------------------------------------------------------

A new variant of W32/Sobig, W32/Sobig.f@MM is a High Risk
mass-mailing worm. It arrives as an email attachment with
a .pif or .scr extension. When run, it infects the host
computer, then emails itself (using its own SMTP engine)
to harvested email addresses from the victim's machine.
In addition, when it propagates, the worm "spoofs" the
"from: field", using one of the harvested email addresses.

Note: The worm copies itself onto the infected machine as:

C:WINNTWINPPR32.EXE

Caution: An infected email can come from addresses you
recognize and may contain the following information:

Subject:
- Your details
- Thank you!
- Re: Thank you!
- Re: Details
- Re: Re: My details
- Re: Approved
- Re: Your application
- Re: Wicked screensaver
- Re: That movie

Attachment:
- your_document.pif
- document_all.pif
- thank_you.pif
- your_details.pif
- details.pif
- document_9446.pif
- application.pif
- wicked_scr.scr
- movie0045.pif

Body:
- See the attached file for details
- Please see the attached file for details

Current and up-to-date VirusScan users are protected from
this threat.

Learn more about W32/Sobig.f@MM:
==> http://us.mcafee.com/root/campaign.asp?cid=8449
Scan for W32/Sobig.f@MM:
==> http://us.mcafee.com/root/campaign.asp?cid=8450