Sobig-F

• Simple virus with effective propagation

• Usual attachment extensions (pif,scr)

• Forged From: address

• Own SMTP engine

• Harvests e-mail addresses from local hard drive

• Contacts NTP server

• If certain time then it downloads code from remote server