Virus Name: W32/Sober.c@MM

Please note: because of the characteristics of this worm you may be at higher risk in Germany or German-speaking regions.

Our email virus scanner has so far been effective against this threat and has blocked all of these virusses to our users.

The virus is received as an email attachment with the following characteristics:

This warning is for the mass-mailing worm written in Visual Basic. Similar to its predecessor (W32/Sober.b@MM) the worm bears the following characteristics:

• contains its own SMTP engine
• target email addresses are harvested from the victim machine
• the worm may carry garbage at end of file, so the file size may be larger than 74,223 bytes.
• outgoing messages may be formatted with varying subject lines and message bodies (in English and German)
• two processes run on the victim machine in order to ensure the worm stays memory resident. Upon termination of one of the processes, the other process restarts it very quickly.

Reference:
W32/Sober.c@MM - http://vil.nai.com/vil/content/v_100912.htm

Related links