Hi, There is no new Sobig worm here. I just ran through samples received by the original poster and I can confirm that these are all Sobig-F samples. The worm is known to be polymorphic which by nature will change the size and content of the code. Nothing new here. Kind regards // Med venlig hilsen Peter Kruse CSIS / Kruse Security ApS http://www.krusesecurity.dk