W32.Sobig.D@mm is a mass-mailing worm that sends itself to all the email addresses it finds in the files with the following extensions:
The email falsely purports that firstname.lastname@example.org sent it.
Email routine details
The email message has the following characteristics:
: W32.Sobig.D@mm spoofs this field. It could be any address.)
The subject line will be one of the following:
Message Body: See the attached file for details
- Re: Documents
- Re: App. 00347545-002
- Re: Movies
- Application Ref: 456003
- Re: Your Application (Ref: 003844)
- Re: Screensaver
- Re: Accepted
- Your Application
The attachment name will be one of the following:
The worm de-activates on July 2, 2003, and therefore, the last day on which the worm spreads is July 1, 2003.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.