Beware new SOBER worm

mbies Boost New Sober Variant

Paul F. Roberts - eWEEK Tue Nov 22, 1:23 PM ET

Anti-virus and e-mail security companies warned Internet users Tuesday
about a new variant of the Sober worm that was flooding e-mail servers
around the world, with help from zombie machines infected by earlier
editions of the same worm.
ADVERTISEMENT

Sober.AG is the latest in a long line of mass e-mail worms.

It appeared Monday, after machines infected with older variants began
spamming out the new version in a massive e-mail flood.

The e-mail messages use a variety of subterfuges to trick recipients
into opening the virus attachment, including messages that pretend to
come from the
FBI and
CIA, security firms said Tuesday.

E-mail security vendor MessageLabs of New York City said it blocked
more than 2.7 million e-mail messages with the new Sober variant since
around 7 p.m. GMT on Monday in what it called a "major offensive."

Symantec Corp. rated the worm, which it dubbed "Sober.X," a "Level 3"
threat on a scale of one to five.

The company has received more than 1,600 samples of the worm from
corporations and 300 from consumers, Symantec said in an e-mail
statement.

For advice on how to secure your network and applications, as well as
the latest security news, visit Ziff Davis Internet's Security IT Hub.

Sober worms are nothing new, but the latest variant is much more widely
distributed than other recent versions because it is being sent out,
simultaneously, from countless other Sober-infected machines, or
"bots," said Symantec.

The new worm also uses a variety of enticing messages, in both German
and English, to trick users.

Messages that appear to come from the FBI or CIA tell users that their
IP address has been logged on "more than 30 illegal Websites," and asks
them to open an attached file containing a "list of questions."

Opening the file launches the Sober worm and infects the computer,
anti-virus vendors said.

Click here to read more insight about the Sober worm from columnist
Larry Seltzer.

Other e-mail campaigns containing the Sober.AG worm promise recipients
a glimpse of videos of jet-setters Paris Hilton and Nicole Richie if
they open the file, according to an e-mail alert from Computer
Associates International Inc.

The FBI issued a statement Tuesday warning the public to avoid falling
for the scam.

Anti-virus vendors advised customers to update their anti-virus
signatures and to be wary of scam e-mail messages. ´

Check out eWEEK.com's Security Center for the latest security news,
reviews and analysis. And for insights on security coverage around the
Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's
Weblog.

On 23 Nov 2005 10:46:10 -0800, "tarzan" <(E-Mail Removed)> wrote:

>mbies Boost New Sober Variant
>
Thanks Tarzan for spreading alarm and despondancy around cyberspace and
clogging up mailboxes with this unnecessary long message. If for whatever
reason anyone feels they may have been infected with this virus then have a
look at:
http://(E-Mail Removed)

David Bradley

On Wednesday 23 November 2005 20:10 David Bradley wrote:

> If for whatever reason anyone feels they may have been infected
> with this virus then have a look at:
>
http://(E-Mail Removed)

"Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows
Server 2003, Windows XP"

- no need to worry:-)

Bill

On Sat, 26 Nov 2005 13:04:42 +0000, B Gruff <(E-Mail Removed)> wrote:

>On Wednesday 23 November 2005 20:10 David Bradley wrote:
>
>> If for whatever reason anyone feels they may have been infected
>> with this virus then have a look at:
>>
>http://(E-Mail Removed)
>
>"Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows
>Server 2003, Windows XP"
>
>- no need to worry:-)
>
>Bill

And the point you are trying to make is?

The subject line reads: "Beware new SOBER worm" - yea so?

The whole is point of the posting was to cause unnecessary worry and concern;
more so for those whose computers that do get infected through a lack of being
proactive in having a locked down system, fully patched and adequately
protected against infections.

The original posting went on and on about the issues but offered no advice as
to how you could determine if the virus was present on your PC or how to clean
it up if it was.

Your contribution was a much use as a choclate tea pot.

David Bradley.