The Sobig Worm sends an email with one of nine subject headings:

Re: Approved
Re: Details
Re: Re: My details
Thank you!
Re: Thank you!
Your details
Re: Your application
Re: Wicked screensaver
Re: That movie

The body of the message says one of two things:

See the attached file for details
Please see the attached file for details.

The attachment is 72K, entitled:

your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif

Don't open these messages.

The attachment, if opened, begins an operation that searches through the files on your computer, looking for email addresses... any string of characters that look like this "anything@whatever2.com". It looks through address books, help files, your temporary internet files, and text files.

Then it emails itself to all those email addresses, but it doesn't say it is from you. It says it is from someone other email address it found on your hard drive.

I'm savvy enough to not open mysterious applications with .pif extensions, but that isn't helping to stop the 3,000 emails I've received from infected computers all across the internet.

Anyway, try to inform your parents about this worm so they don't open mail with these nine subject lines... and don't bother sending mail with these subject lines, they will get deleted. These subjects are now blacklisted until September.

If you would like to know if your computer has been running the soBig virus, search for a file called WINPPR32.EXE if you don't have it, your computer hasn't been running the soBig virus.