Update your Virus Protection Software Definitions Whether that be Norton or McAfee, etc, run the update so that your software has latest knowlege of this worm.
Enable the Firewall for your internet connection. This can be done easily by going to Network Connections (Start/Accessories/Communications) and right-clicking your internet connection icon, then selecting Properties. Select the Advanced tab and check the box at the top that is labeled by Internet Connection Firewall.
W32.Sobig.F@mm
For a very complete and thorough set of instructions for removing this virus, please visit:
Symantec's page on this worm
Disable System Restore (Windows Me/XP).
Update your Virus Protection Software Definitions :: Whether that be Norton or McAfee, etc, run the update so that your software has latest knowlege of this worm.
Do one of the following:
• Windows 95/98/Me: Restart the computer in Safe mode.
• Windows NT/2000/XP: End the Trojan process.
Run a full system scan and delete all the files detected as W32.Sobig.F@mm.
Delete the value that was added to the registry.
W32.Sobig.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in the files that have the following extensions: (.dbx .eml .hlp .htm .html .mht .wab .txt)
The worm uses its own SMTP engine to propagate and attempts to create a copy of itself on accessible network shares, but fails due to bugs in the code.
Look for the following in the Subjects of emails containing the virus:
Re: Details
Re: Approved
Re: Re: My details
Re: Thank you!
Re: That movie
Re: Wicked screensaver
Re: Your application
Thank you!
Your details
