Sobig.D is a worm that does not have any destructive effects, which spreads via e-mail and across networks. The message carrying this worm is easy to identify, as the message text is always: See the attached file for details.

Once it has infected a computer, Sobig.D looks for e-mail addresses in all the files it finds on the affected computer with the following extensions: TXT, EML, HTM, HTML, DBX and WAB. It then sends a copy of itself to all these addresses.

Sobig.D can also copy itself to the Startup directories in the computers connected to the same network as the affected computer.

Sobig.D is easy to recognize when it spreads via e-mail, as the message text is always: See the attached file for details.