SoBig virus infections on the rise

Despite being a crude piece of work, the SoBig-A virus is still spreading rapidly.

The worm has been in the wild for less than a week, and infections were thought to have peaked. But antivirus vendors are reporting an alarmingly large number of infections.

"I'm quite shocked because it's not the most cunning worm in the world. It's very simple and easy to spot," said Carole Theriault, antivirus specialist at Sophos.

"This is a perfect example of why companies need to better organise their internet strategy, blocking attachments and educating staff."

SoBig-A affects PCs running Windows 95 onwards. It contains an SMTP engine to mail itself out to all addresses on the PC, and can spread through network shares.

The worm uses four subject headers and attached file names. These are: 'Re: Movies', 'Re: Sample', 'Re: Document' and 'Re: Here is that sample'.

The infected attachments are: 'Document003.pif', 'Sample.pif', 'Untitled1.pif' and 'Movie_0074.pif'.

"Over the past four days it's at number two in our chart, just behind Klez," said Eric Chen, head of research at Symantec.

"The main method of infection now seems to be through network shares, and people need to make sure this avenue is closed off to SoBig-A and other malware."

SoBig-A removal utilities are available form all major antivirus vendors.