Newbie sobig worm

["Sheila R. White" <captaininvictus hotmail com>]

sendmail/redhat 7.2

I am trying to understand the theory.

We were hit with sobig worm.

Client are win/98 outlook express users.
1. 5 individuals were affected.
2. these 5 have their email posted on the company website.
3.no one else had evidence of the worm. (500) users.
4. inflex is sending admin emails indicating these same 5 users are
attempting to send recieve exe,pifs etc. recieving appr. 200+ alerts per
day.

is there something i am missing or should be looking for/

thanks