SoBig began spreading shortly after the Lirva worm gained prominence. Lirva disables antivirus and security software, prompting Ken Dunham, Senior Intelligence Analyst for iDEFENSE Inc., to caution, "SoBig is spreading in the wild during a time where many computers may not have anti-virus and security-related software installed correctly. Many worms and other malicious codes today are successfully disabling anti-virus and security-related software. This has resulted in an increasingly large pool of computers on which malicious code easily spread without detection."

F-Secure promptly added detection for the worm on January 9, 2002. Other antivirus software updated January 10, 2002 or later should be able to effectively detect and remove the worm. If you do not currently have antivirus software, you may get a free online scan, compliments of Trend Micro's Housecall. You can also use products such as MailDefense to stop email worms without the need for updates.

Update: On May 18, 2003, a new variant of SoBig was discovered, this time sending itself as if "from" support@microsoft.com instead of big@boss.com. Details on this variant of Sobig can be found here.