Security threats Toolkit

Sober worm now 4 percent of all email

Tags:
Sophos,
Sober

Dan Ilet ZDNet.co.uk

Published: 04 May 2005 18:10 BST

One in every 22 emails circulating the Internet on Wednesday contained the latest version of the Sober worm, according to latest statistics from a UK antivirus company.

Sophos claimed that the mass-mailing worm, which has been reported in 40 countries after first appearing on Monday, now accounts for 79 percent of all viruses the company is seeing.

"It's still very widespread," said Graham Cluley, senior technology consultant for Sophos. "It appears to turn off Symantec's antivirus protection and the Windows XP firewall. It seems to do that to set up future attacks." He went on to say that the worm is likely to be preparing computers to distribute spam.

"That's probably why it has become widespread so quickly," he said. "[Virus writers] used spam technology to send it out. Now it's just perpetuating."

Sober.P — which security companies have variously tagged as Sober.N, Sober.O or Sober.S — travels as an attachment in emails written in English and German. One of the most widely reported email contains an alluring message stating that the recipient has won free tickets to the 2006 World Cup in Germany, but many other types have also been spotted. Once opened, the virus sends itself to email addresses harvested on the infected machine.