Sober email worm gives Windows users the DTs

Sober email worm gives Windows users the DTs
John Leyden, The Register 2003-10-28

A virus which poses as a security fix from an AV firm is the latest menace to assault Windows users.

Sober typically spreads by email. The viral messages it generates have infectious attachment names such as typically anti_virusdoc.pif, check-patch.bat, playme.exe and variable English and German subject lines. A full list can be found in an advisory from Finnish AV firm F-Secure.

Windows users foolish enough to open the infectious attachments get the pox. On infected machines, the worm makes certain registry changes and installs its own SMTP client to further its spread.

MessageLabs, the email filtering firm, reports that it has blocked the worm more than 3,400 times since its first appearance at the weekend. In three-quarters of the cases , the Sober worm came from Germany.

Most AV vendors rate the virus as low to medium risk.

Standard defence precautions against viral attacks apply: corporates should consider blocking executables at the gateway and update AV signature definition files to detect the virus. Home users should also update AV tools and resist the temptation to open suspicious looking emails. The use of free spam-nuking tools, such as Spam Assassin, can help. ®