: As of June 13, 2003, due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from Category 3 to Category 2.
W32.Sobig.C@mm is a mass-mailing worm that sends itself to all the email addresses that it finds in the files with the following extensions:
The email falsely purports that Microsoft sent it (firstname.lastname@example.org).
Email Routine Details
The email message has the following characteristics:
: W32.Sobig.C@mm spoofs this field. It could be any address.)
The subject line will be one of the following:
Message Body: Please see the attached file
- Re: Movie
- Re: Submited (004756-3463)
- Re: 45443-343556
- Re: Approved
- Re: Your application
- Re: Application
The attachment name will be one of the following:
The worm de-activates on June 8, 2003, and therefore, the last day on which the worm will spread is June 7, 2003.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.