Security threats Toolkit

Europe threatened by Sober 'epidemic'

Tags:
Sober

Dawn Kawamoto CNET News

Published: 04 May 2005 09:25 BST

The latest Sober worm has spread rapidly in the past 24 hours and now makes up two-thirds of virus traffic on the Internet, according to security experts.

Sober.P, first detected on Monday, now accounts for 77 percent of all viruses detected by Sophos's threat-monitoring stations worldwide, the British security company said on Tuesday. At the same time, Kaspersky Labs, a Russian maker of antivirus software designed to combat such threats, described the worm's spread in Western Europe as an "epidemic".

"This is a pretty significant virus. We usually don't see it spread to 77 percent of all inbound viruses," Gregg Mastoras, a senior security analyst at Sophos, said. "Usually, it spreads much slower, and users have time to update their computers."

Variants of Sober have been circulated since 2003 and have continued to hit corporate and home systems. The mass-mailing worm has continued to spread because people still open attachments in infected email, despite warnings.

The latest Sober offshoot, which has been tagged as Sober.N, Sober.O or Sober.S at other security companies, uses email written in both English and German. One of its lures is a message saying the recipient has won free tickets to the 2006 World Cup in Germany. Once victims open the infected attachment, the virus harvests email addresses from their machine. The virus then copies itself onto the user's computer and then sends a similar email to the harvested addresses.

The World Cup message could account for the rapid spread of the virus in Europe, Sophos said. "Many people will be eager to attend one of the biggest sporting events in the world next year, and may think it's worth the risk of opening the email attachment just in case the prize is for real," Graham Cluley, senior technology consultant for Sophos, said in a statement.

The British company claimed that the worm has "broken records in terms of the number of infected messages sent out and speed of propagation throughout Western European segments of the Internet."

Sober.P may end 2005 as one of the worst viruses. Last year, Netsky.P, which accounted for 22.6 percent of all virus incidents, held that title, according to Sophos.