Just as Internet users were recovering from the Blaster worm virus of last week, a new threat has arrived to take its place. W32.Sobig.F@mm is a trojan virus that will copy and send itself to email addresses it finds on the infected computer. It may also steal passwords and other system information.

The virus is known to create a sender address from files found in the infected computer, or may also appear as admin@internet.com. To accurately spot W32.Sobig.F@mm look for these warning signs:

Subject:

• Re: Details
• Re: Approved
• Re: Re: My details
• Re: Thank you!
• Re: That movie
• Re: Wicked screensaver
• Re: Your application
• Thank you!
• Your details

Attachment:

• your_document.pif
• document_all.pif
• thank_you.pif
• your_details.pif
• details.pif
• document_9446.pif
• application.pif
• wicked_scr.scr
• movie0045.pif

The virus will de-activate itself on September 10, 2003. If you do become infected Symantec has created a removal tool which you can find here: http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.removal.tool.html. The virus can also be removed by running a full system virus scan using Norton or MacAfee software.

For more information or to learn about other threats visit the Symantec website at www.symantec.com.

If you enjoyed this article, be sure to visit CanadaOne's article knowledge base for more informative articles.