W32.Sobig.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in the files with the following extensions:

• .dbx
• .eml
• .hlp
• .htm
• .html
• .mht
• .wab
• .txt

The worm uses its own SMTP email engine to propagate and will attempt to create a copy of itself on accessible network shares if your computer is on a network.

The email message has the following characteristics:

From: Spoofed address (which means that the sender in the "From" field is most likely not the real sender).
The worm may use the address admin@internet.com as the sender.

Subject:

• Re: Details
• Re: Approved
• Re: Re: My details
• Re: Thank you!
• Re: That movie
• Re: Wicked screensaver
• Re: Your application
• Thank you!
• Your details

Body:

• See the attached file for details
• Please see the attached file for details.