This from Trend:

WORM_SOBIG.E

This nondestructive worm propagates via network shares and via email
using its own SMTP (Simple Mail Transfer Protocol) engine. It gathers
its target email addresses from files with WAB, DBX, HTM, HTML, EML and TXT
file extensions.

The email message has varying subjects, and has a messsage body that
states "Please see attached file." It also contains a ZIP file attachment
with the file name Your_details.zip. This ZIP file contains the copy of
the worm with the filename DETAILS.PIF.

I note that Spam Assassin is scoring emails with the SoBig worm somewhere in the 6.4 to 7 range (our cutoff is 7.5). I'm was going to tinker with the Spam Assassin rules to see if I could filter it out.

However, I noticed that 12:01 local time, all of the SoBig emails stopped including an attachment. Based on what I read on the Symantec site about SoBig shutting down the day after it stops infection (which they say is Sept 5), my guess is that it will shut down tomorrow.