I checked before posting and did not see another posting of this already. I saw this when reading the news online from a local TV news site.

It gets you with subject likes like "Thank You", Resume" or "Your Details"

Here is more information at the symantec website.

Help.

My antivirus Protectorplus crashes when it detects this SobigF worm.

Symantec doens't fix it. How do i get rid of this nasty %$^&*()_+$#$ ?

This morning I had 35 email messages with attachments infected with the W32/Sobig.f@MM virus. My Norton 2003 Anti-Virus detected and deleted all of them. There were 35 infected files in the Quarantine area, which I removed.

Mcafee removal instructions - Sobig worm

Norton Sobig.f worm removal tool.

Please note, the above links all refer to the "Sobig.f worm". There are many others (Sobig.A worm, Sobig.B worm, etc.) with similar names. If yours is different, try this Norton page: Norton Expanded Tool List

I hope this helps!

Dwight

Thanks Esencia and Dwight. Took me two days to remove it from the forbidden Registry. My AV removed one of 148 inf. files and then crashed with each subsequent file until I deleted "ppmail" someplace in the registry.

My pc is still working after the Registrectomy. Here's hoping for tomorrow.

Just found the original Answerpool posting (Posted by me in January)
Has some more details on the Worm

quote:

---

http://www.answerpool.com/groupee/forums?a=tpc&s=669605981&f=489601891&m=2666059202

---

Bedstor:

This is a new variation of the SoBig virii (SoBig-F).. You have to use the exact removal tool for this one..

Murray

Hi Murray
God help the guy who attracts several different Versions of SoBig (Need several different removal patches?) when I originally posted that was Version A Now the Latest Version is F 6 different versions since that post!! (I'm Gobsmacked!! )
Have the latest top 10 virus list in front of me SoBig is at 1(E),4(A),5(B),and 8(D)
Ex www.sophos.com (July 2003)

No kidding.. Almost seems the av people get a fix for one virii about 2 steps behind what the latest script kiddies have put out..

Condiering there are a couple variants to msblast out there already (one the same day msblast hit), it's a wonder we can even keep our systems up and running !!

Murray