April 19, 2005 10:51 AM PDT
Sober worm makes a comeback
- Related Stories
Worm attack forces Reuters IM offlineApril 14, 2005
Site-blocking worm carries phishing riskApril 11, 2005
Fake Microsoft security updates circulateApril 8, 2005
International bank HSBC deluged by virusesApril 5, 2005
IM threats rising sharply, reports confirmApril 5, 2005
E-mail worm graduates to IMApril 4, 2005
Security experts said Tuesday that the worm, dubbed Sober.M, reports e-mail addresses of victims back to its anonymous author--a technique known as harvesting. Spammers typically buy these fresh addresses to add to their lists of e-mail recipients.
The e-mail containing the worm is written in bad English with the subject line: "I've got your e-mail on my account."
"It looks like the virus writer is deliberately using broken English to (convince) people the e-mail is not a virus," Graham Cluley, senior technology consultant at antivirus company Sophos, said in a statement.
Sophos said that the new Sober variant was the fifth most reported virus over the last 24 hours, closely followed by versions of Zafi and Netsky. It's thought that all the major antivirus companies are now offering protection against the worm, so users should update their virus protection.
Sober.M is a mass e-mailing virus that spreads as a .zip file attachment and affects systems running Microsoft Windows. The e-mail containing the worm sends itself in German or English language. The English version of the e-mail is below.
Subject line: I've_got your E-mail on my_account!
First, Very Sorry for my bad English.
Someone is sending your private e-mails on my address.
It's probably an e-mail provider error!
At time, I've got over 10 mails on my account, but the recipient are you. I have copied all the mail text in the windows text-editor for you & zipped then. Make sure, that this mails don't come in my mail-box again. bye
Attached file: your_text.zip
Dan Ilett of ZDNet UK reported from London.