SoBig Virus Returns

Yet another version of the resilient virus began spreading rapidly on the Internet Tuesday morning.

Welcome to the summer of the worm.

Hard on the heels of the , yet another version of the resilient and ever-popular SoBig virus began spreading rapidly on the Internet Tuesday morning. Known as SoBig.F, the new variant behaves much like its older siblings, infecting Windows machines via e-mail and sending out dozens of copies of itself.

The variant began spreading early Tuesday Eastern time, and by 9 a.m. Tuesday, MessageLabs Inc. had stopped more than 10,000 copies. The virus size is approximately 73 KB, and the attachment that actually contains the malicious code can carry any one of a number of names, according to iDefense Inc., a security company based in Reston, Va. Among the file names seen so far are:


The subject line of the e-mail message that carries the attachment is also randomized, and many of the subjects are similar to previous SoBig variants. They include:

Re: Details
Re: Approved
Re: Re: My details
Re: That movie
Re: Thank you!
Re: Your application
Re: Wicked screensaver
Thank you!
Your details

SoBig.F installs a copy of itself in the Windows registry, in a file named "winppr32.exe." MessageLabs lists the worm as originating in the Netherlands, and its statistics show that SoBig.F has spread mainly in that country and Norway at this point. However, that is likely to change as workers in North America begin checking their e-mail Tuesday.


Click here

for tips on battling SoBig.

SoBig.Fs appearance comes just eight days after the initial onset of the Blaster worm, which has infected several hundred thousand Windows PCs.