Security threats Toolkit

Sober worm hits new heights

Tags:
Worm,
Sober

Dan Ilet ZDNet.co.uk

Published: 09 May 2005 12:45 BST

The Sober.P worm is circulating the Internet in greater quantities than ever, according to an antivirus company on Monday.

Sophos has reported that the mass-mailing worm now accounts for 5.4 percent of all email and 84 percent of virus activity that the company saw over the weekend. That has risen from Friday's figures, which were 4.65 percent of all email and 77 percent of virus activity.

"The strange thing is that we're actually seeing more reports than ever," said Graham Cluley, senior technology consultant for Sophos. "It's increased and it's even worse than last week. We don't know how many people are infected, but those infected are just spewing these emails out."

Cluley said that the second most prevalent virus, Netsky.P, accounted for 0.3 percent of all email viruses, and Zafi.D, the third most popular worm, was just 0.082 percent. "Those have been big viruses, but have been dwarfed by the Sober worm," he said.

Last week, Sophos said that the worm turned off Symantec's antivirus protection and Microsoft's Windows XP firewall on infected machines.

Sober.P — which security companies have variously tagged as Sober.N, Sober.O or Sober.S — travels as an attachment in emails written in English and German. One of the most widely reported emails contains an alluring message stating that the recipient has won free tickets to the 2006 World Cup in Germany, but many other types have also been spotted. Once opened, the virus sends itself to email addresses harvested from the newly infected machine.