Topic: Sober worm makes a comeback

[Clive]

Dan Ilett
ZDNet UK
April 19, 2005, 17:20 BST
 
Virus writers have resurrected the Sober worm with a new variant that is spreading quickly over the Internet, according to security experts on Tuesday afternoon.

The worm, dubbed Sober.M, reports email addresses of victims back to its anonymous author ? a technique known as harvesting. Spammers typically buy these fresh email addresses to add to their lists of email recipients.

The email containing the worm is written in bad English with the subject line: "I've got your email on my account."

"It looks like the virus writer is deliberately using broken English to [convince] people the email is not a virus," said Graham Cluley, senior technology consultant for antivirus firm Sophos.

Sophos said that the worm was fifth most reported virus over the last 24 hours, closely followed by versions of Zafi and Netsky. It's thought that all the major anti-virus companies are now offering protection against the worm, so users should updated their virus protection.

Sober.M is a mass emailing virus that spreads as a .zip file attachment. The email containing the worm sends itself in German or English language. The English version of the email is below.


Subject line: I've_got your EMail on my_account!


Message text:


Hello,
First, Very Sorry for my bad English.
Someone is sending your private e-mails on my address.
It's probably an e-mail provider error!
At time, I've got over 10 mails on my account, but the recipient are you. I have copied all the mail text in the windows text-editor for you & zipped then. Make sure, that this mails don't come in my mail-box again. bye


Attached file: your_text.zip

[Clive]

A new variant of this worm (Sober N) is spreading across the Internet.  The message is identical.

[Simon]

Will it never end?

I sometimes wonder if it's not the anti-virus firms who persist in inventing these things, to keep themselves in business.  Surely 90% of computer users now know never to open an unexpected attachment?

[Clive]

Well I receive up to a dozen of these alerts every day and most of them admit that "there are no reports of this virus in the wild".  This does tend to back up your theory Simon!

[Clive]

Europe threatened by Sober 'epidemic'

Dawn Kawamoto
CNET News.com
May 04, 2005, 09:25 BST
 
The latest Sober worm has spread rapidly in the past 24 hours and now makes up two-thirds of virus traffic on the Internet, according to security experts.

Sober.P, first detected on Monday, now accounts for 77 percent of all viruses detected by Sophos's threat-monitoring stations worldwide, the British security company said on Tuesday. At the same time, Kaspersky Labs, a Russian maker of antivirus software designed to combat such threats, described the worm's spread in Western Europe as an "epidemic".

"This is a pretty significant virus. We usually don't see it spread to 77 percent of all inbound viruses," Gregg Mastoras, a senior security analyst at Sophos, said. "Usually, it spreads much slower, and users have time to update their computers."

Variants of Sober have been circulated since 2003 and have continued to hit corporate and home systems. The mass-mailing worm has continued to spread because people still open attachments in infected email, despite warnings.

The latest Sober offshoot, which has been tagged as Sober.N, Sober.O or Sober.S at other security companies, uses email written in both English and German. One of its lures is a message saying the recipient has won free tickets to the 2006 World Cup in Germany. Once victims open the infected attachment, the virus harvests email addresses from their machine. The virus then copies itself onto the user's computer and then sends a similar email to the harvested addresses.

The World Cup message could account for the rapid spread of the virus in Europe, Sophos said. "Many people will be eager to attend one of the biggest sporting events in the world next year, and may think it's worth the risk of opening the email attachment just in case the prize is for real," Graham Cluley, senior technology consultant for Sophos, said in a statement.

The British company claimed that the worm has "broken records in terms of the number of infected messages sent out and speed of propagation throughout Western European segments of the Internet."

Sober.P may end 2005 as one of the worst viruses. Last year, Netsky.P, which accounted for 22.6 percent of all virus incidents, held that title, according to Sophos.