November 15, 2005 5:06 PM PST

New Sober virus circulating

There are at least three new variants of the Sober worm spreading across the Internet via e-mail messages. The viruses are activated once a user clicks on an infected attachment.

The new variants of Sober, a worm that first appeared in 2003, are capable of disabling antivirus programs, according to Finland-based company F-Secure.

Antivirus company Kaspersky Lab said on its Web site that large numbers of infected e-mails have been intercepted. This confirms, according to the company, that the epidemic was caused by spamming. Kaspersky identified the variants as Sober.U, Sober.V, and Sober.W.

Internet security officials in Germany warned Monday of a possible Sober attack. In recent months, Sober has been used in that country to old class photo sent by a schoolmate.

Sober can hijack a Windows-based computer and force it to send spam e-mails. The continuous e-mailing can lead to overloaded servers and reduced network performance.

Security firms cautioned computer users to be careful when opening attachments. Infected messages may have a random subject line or none at all, Kaspersky said.

But the attachments can be recognized by their names: Exceltab-packed_List.exe, Liste.zip and Reg-List-Dat_Packer2.exe., reg_text.zip Word-Text.zip, Word-Text_packedList.exe and Word-Text_packedList.zip.

The virus creators appeared to taunt security experts with a message left in the code which reads: "Use your debuggers, it's fun."

2 comments

Join the conversation!
Add your comment (Log in or register)
Worms detection software
I installed a new worm detection software 2 days ago on my PC.This morning one of the PCs on the network got infected with Sober.e and immediately I was able to identify the PC sending out the worm. Within the hour the IT guys clean the infected PC before other PCs get infected. Cool software that does 2 things ie detecting worm on the network and identifying infected PC
Posted by soon999 (1 comment )
Reply Link Flag
You might also try
2 additional things. First, try filtering. There is no reason .pif, .exe, any executable content type files should be emailed. If you run your own email server, just set it to toss these types. If not, talk to those that do run your mail server.
Second, look at a program called 'DropMyRights' from MS. It allows you to start individual programs at a lower rights level. If some users need to run as admins(for whatever reason), starting all internet facing programs this way works really well.
Posted by catchall (246 comments )
Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

Inside CNET News

1-2 of 12

Scroll Left Scroll Right

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

Markets

Market news, charts, SEC filings, and more

Related quotes

Dow Jones Industrials (0.57%) 72.81 12,874.04
S&P 500 (0.68%) 9.13 1,351.77
NASDAQ (0.95%) 27.51 2,931.39
CNET TECH (0.84%) 17.13 2,049.14
  Symbol Lookup