What's Going on here?

[Jason Balicki]

>I've seen a few instances like this and having quarantined them, I sent
>them to Sophos. They were all broken copies. I've also sometimes seen
>Sobig-like attachments which were in fact empty. There were quite a lot
>like this with Bugbear which caused them to issue the Bugbear-Dam ide.

Indeed, they have sent me a sbf-dam.ide that doesn't appear to have
been publicly released (yet).  If anyone is interested, you can email me
and I'll send it along.  Also, I'm sure Sophos would be happy to send
it to anyone who asks.

--J(K)