Sobig.F Virus

Information about the 'Sobig.F' worm.

Virus name:   Sobig.F

Status:   Real.

Origins:   Sobig.F is the latest variant of yet another mass-mailing worm which exploits a vulnerability in the Microsoft Outlook e-mail client on Windows 95, 98, ME, NT, 2000, and XP platforms to replicate itself by mailing out messages with forged return addresses. The payload is contained in attachments to messages bearing one of the following subject lines:

  • My Details

  • Your Details

  • Thank you!

  • That movie

  • Approved

  • Application

  • Wicked screensaver

  • Re: My Details

  • Re: Your Details

  • Re: Thank you!

  • Re: That movie

  • Re: Details

  • Re: Approved

  • Re: Your application

  • Re: Wicked screensaver

The file name of the infected attachment will match one of the following:

  • wicked_scr.scr

  • movie0045.pif

  • your_document.pif

  • document_all.pif

  • thank_you.pif

  • your_details.pif

  • details.pif

  • document_9446.pif

  • application.pif

Trend Micro provides a system cleaner on its web site which will remove Sobig.F.

Additional Information:


Last updated:   29 January 2008
Since 1994
A Word to Our Loyal Readers

Support Snopes and make a difference for readers everywhere.

  • David Mikkelson
  • Doreen Marchionni
  • David Emery
  • Bond Huberman
  • Jordan Liles
  • Alex Kasprak
  • Dan Evon
  • Dan MacGuill
  • Bethania Palma
  • Liz Donaldson
  • Vinny Green
  • Ryan Miller
  • Chris Reilly
  • Chad Ort
  • Elyssa Young

Most Snopes assignments begin when readers ask us, “Is this true?” Those tips launch our fact-checkers on sprints across a vast range of political, scientific, legal, historical, and visual information. We investigate as thoroughly and quickly as possible and relay what we learn. Then another question arrives, and the race starts again.

We do this work every day at no cost to you, but it is far from free to produce, and we cannot afford to slow down. To ensure Snopes endures — and grows to serve more readers — we need a different kind of tip: We need your financial support.

Support Snopes so we continue to pursue the facts — for you and anyone searching for answers.

Team Snopes