Security threats Toolkit

New worms turn up

Will Sturgeon silicon.com

Published: 21 Feb 2005 16:15 GMT

Several new worms have been spotted in the wild today including a variant of Sober; a variant of Bropia; and a new MyDoom -- taking the total number of variants of that worm beyond 50.

However, despite a flurry of activity none of these worms are cause for too much concern at current levels.

The Sober.K worm is a mass-mailer and some versions intercepted by UK email security firm MessageLabs pose as a virus warning urging users to download a patch to protect them from the very worm they install by doing so.

The self-referential subject line of these emails reads: "Alert! New Sober worm". Other subject lines include references to illegal Web sites visited and also the notorious Paris Hilton sex video.

MessageLabs spotted the first version at 0501 (GMT) in Germany. So far the company has blocked over 1,400 copies with subject lines and text in English and German.

MyDoom variant .BA, which has also been spotted in small numbers, is more of interest as a curiosity, as the malware embarks on its third foray through the alphabet according to common naming policy employed by Symantec and Trend. Others antivirus firms are calling it .AX, .AZ and even .BC as each new variant is named alphabetically.

Bropia.J (or Bropia.I) is also spreading in small numbers with the capability to spread via MSN Messenger, according to an alert on the Computer Associates Virus Information Centre.