Our computer guru at work sent this via our in house e-maill just now...

Sobig Virus Picks Up Steam
After taking most of 2002 off, the world's virus writers seem to be making up for lost time in the early part of 2003. A new virus, known as Sobig, is spreading rapidly Monday on the Internet, infecting machines worldwide. The virus, which appears to attack Windows machines running Microsoft Corp.'s Outlook e-mail client, was first seen late last week but has picked up considerable steam in the last 24 hours. MessageLabs Ltd., a British company that tracks viruses, has seen more than 10,000 copies of
Sobig on Monday alone and more than 20,000 copies total. Some users in the United States on Monday were being flooded with virus-infected messages, some receiving as many as 20-30 an hour. Not much is known about the virus at this point, but it seems to be a mass-mailing worm that behaves much like the Lirva worm that began spreading last week. It arrives via e-mail, always in a message from the address big@boss.com and carrying one of four subject lines:
Re: Movies; Re: Document; Re: here is that sample; Re: Sample
The message also includes an attachment, whose filename could include Document003.pif, Sample.pif, Movie_0074.mpeg.pif and Untitled1.pif, according to MessageLabs analysis of the virus.
Sobig uses its own SMTP (simple mail transfer protocol) engine to mail copies of itself to addresses that it finds on the infected machine's hard drive and e-mail address book. The virus also copies itself to two shared folders on shared network drives. Sobig then downloads from a Geocities site a file that contains a link to another file located elsewhere on the Internet. The worm downloads this second file and executes it on the infected machine. It's unclear what the file does. Anti-virus vendor Trend Micro Inc. said the worm might also send an e-mail to its creator, notifying him of which machines are infected.

W32.Sobig.A@mm


Onward to The Land of the Midnight Sun!