Security threats Toolkit

All quiet on the Sober front

Tags:
Sober

Tom Espiner ZDNet.co.uk

Published: 06 Jan 2006 18:10 GMT

The Sober attack predicted for Friday has not happened, possibly because publicity earlier this week about the potential of an outbreak..

PCs that were infected by Sober in November had the potential to download malicious code from certain Web sites and then launch a new wave of viruses on 6 January.

Experts from F-Secure confirmed on Friday that they have not seen any evidence of an attack.

"It's great! This is good news," Mikko Hyppönen, director of antivirus research at F-Secure, told ZDNet UK.

"We've been monitoring the locations of the files that infected machines are now trying to download. So far none of them have activated," said Hyppönen.

MessageLabs also confirmed that it had seen no successful attack,

"We've not seen anything. This is what we envisioned would happen. Everyone knew about [the imminent attack], and took steps to mitigate the effects. The virus writer is probably running scared. It's great — everybody in the antivirus community helped each other out. It would be good to do this with more malware," said Mark Toshack, manager of antivirus operations at MessageLabs.

But F-Secure warned that now was not the time to be complacent, as the hacker could still try to activate the download routine.

"The Sober guy laid low, but he might publish a little later. We've seen secondary download routines with other variants uploaded by the writer when he's ready — so perhaps he's still writing it. It doesn't necessarily mean he won't activate the threat in the future."