To print: Click here or Select File and then Print from your browser's menu

This story was printed from silicon.com, located at http://www.silicon.com/

Story URL: http://software.silicon.com/malware/0,3800003100,39130136,00.htm

Sober virus now infects one in 22 emails
Rise of the mass-mailing worm...

By Dan Ilett

Published: Thursday 05 May 2005

One in every 22 emails circulating on the internet contains the latest version of the Sober worm, according to statistics from a UK antivirus company.

Sophos claimed that the mass-mailing worm, which has been reported in 40 countries after first appearing on Monday, now accounts for 79 per cent of all viruses the company is seeing.

Graham Cluley, senior technology consultant for Sophos, said: "It's still very widespread. It appears to turn off Symantec's antivirus protection and the Windows XP firewall. It seems to do that to set up future attacks." He went on to say that the worm is likely to be preparing computers to distribute spam.

"That's probably why it has become widespread so quickly," he said. "[Virus writers] used spam technology to send it out. Now it's just perpetuating."

Sober.P - which security companies have variously tagged as Sober.N, Sober.O or Sober.S - travels as an attachment in emails written in English and German. One of the most widely reported email contains an alluring message stating that the recipient has won free tickets to the 2006 World Cup in Germany, but many other types have also been spotted. Once opened, the virus sends itself to email addresses harvested on the infected machine.

Dan Ilett writes for ZDNet UK