VIRUS COMPANY iDefense said that the SoBig virus has started to proliferate again.
The virus installs a copy of itself in the Windows directory as a firm called winppr32.exe, and then the registry is changed so that the worm executes at startup.
The file size, said iDefense, varies in order to attempt to thwart anti-viral software, and typically comes as an attachment with email subject headings such as Re: Details, Re: Approved, Re: Re: My details, Re: That movie, Re: Thank you!, Re: Your application, Re: Wicked screensaver, Thank you!, Your details
Source:
http://www.theinquirer.net/?article=11115