Hi Helen,
I am also getting loads and loads of emails with .pif attachments. All those mails flooding my inbox are coming from email addresses of people who are in some way or other connected to The Libertines. It looks like someone who has all these email addresses in their address book has been infected by a computer worm. That computer worm is really harmless. You can find a removal tool by clicking this link:
http://isc.sans.org/diary.html?date=2003-08-19
I ran the removal tool on my computer and it was not infected, so it must be someone else.
Alex
------------
WORM_SOBIG.F
Description:
[...]
This worm propagates by mass-mailing copies of itself using its own Simple Mail Transfer Protocol (SMTP) engine. It collects email addresses from files with the following extensions:
DBX
HLP
MHT
WAB
HTML
HTM
TXT
EML
It sends out email messages with the following details:
Subject: <any of the following:>
Re: Thank you!
Thank you!
Re: Details
Re: Re: My details
Re: Approved
Re: Your application
Re: Wicked screensaver
Re: That movie
Message body: <any of the following:>
See the attached file for details.
Please see the attached file for details.
Attachment: <any of the following:>
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif
Size of virus: ~72,295 Bytes
It may spoof the FROM field using email addresses found on the infected machine so that its email messages appear to originate from one source but was actually sent from another.
This worm deactivates its propagation routine on September 10, 2003.
This worm runs on Windows 95, 98, ME, NT, 2000, and XP.