New Variant Of Sobig Worm Spreading Fast

Sobig.F arrives as an e-mail with subject lines including "Your details," "Re: Approved," "Re: Thank you!" and "Re: That movie." Attachment names include "your_document.pif," and "details.pif."

When the attachment is executed, the worm spreads itself using its own SMTP engine to e-mail addresses on the victim's system.

Message Labs, a managed e-mail security provider, said it had intercepted 31,100 copies of Sobig.F so far. Network Associates rated the worm as a medium threat.

Ken Dunham, malicious code intelligence manager at Reston, Va.-based security firm iDefense, said in a prepared release that "garbage" characters are appended to Sobig.F in an attempt to make it difficult to detect.

The worm will deactivate on Sept. 10, according to Symantec.