COVID-19 UPDATE: How Data Doctors is preparing & responding. Learn more >

Another W32.Sobig worm was found running Wild this week!


Beware of the [email protected] worm that was discovered 6-25-03 and is already rated a category 3 on Symantec Security Response.


This question was answered on June 27, 2003. Much of the information contained herein may have changed since posting.

Symantec Security Response has upgraded [email protected] from a Category 2 to a 3 as of June 26, 2003 This is a completely different worm then [email protected] & [email protected]

[email protected] is a mass-mailing worm That sends itself to all email addresses that it finds in the files with the following extensions:

- .wab

- .dbx

- .htm

- .html

- .eml

- .txt

This is considered to be a very wild worm The email comes in disguise as something from Yahoo and has an attachment

The email message has the following characteristics:

Subject: It is one of the following:

- Re: Application

- Re: Movie

- Re: Movies

- Re: Submitted

- Re: ScRe:ensaver

- Re: Documents

- Re: Re: Application ref 003644

- Re: Re: Document

- Your application

- Application.pif

- Applications.pif

- movie.pif

- Screensaver.scr

- submited.pif

- new document.pif

- Re: document.pif

- 004448554.pif

- Referer.pif

Attachment: It is one of the following:

- (contains Details.pif)

- (contains Application.pif)

- (contains Document.pif)

- (contains

- (contains Movie.pif)

Most Windows operating systems are affected

NOTE: The worm de-activates on June 14, 2003, and therefore, the last day on which the worm will spread is June 13, 2003

Symantec advises all possible victims to download latest virus definitions immediately and deploy

Get complete instruction on protection and removal from Symantec at:

<a href="[email protected]">[email protected]mm.html</a>

Need Help with this Issue?

We help people with technology! It's what we do.
Schedule an Appointment with a location for help!


Posted by Michal of Data Doctors on June 27, 2003