Internet security firm Sophos first detected the worm on Wednesday. It has been found in e-mails with the subject lines mail delivery sytem (sic) failure, mail delivery failed, server system failure and gateway system failure. The first line of the e-mail contains messages such as 'converting message, please wait' and 'please wait while loading failed message'.