Sober variant goes on the rampage

Several million infected emails have been already been detected

Security firm F-Secure has issued a Radar Level 1 alert on a new variant of the Sober internet worm being sent as an email attachment.

Level 1 is the highest on F-Secure's three-step alerting system. Several million infected emails have been detected.

F-Secure said that the worm seems to be very successful in spreading partly because the messages contain bogus warnings from the FBI, the CIA or the German Bundeskriminalamt.

The emails arrive with an attachment, which will infect the computer once opened.

The first Sober worm was found in October 2003, and F-Secure believes that all 25 variants have been written by the same individual, possibly based in Germany.

Unlike most other widespread viruses, Sober does not seem to have a clear financial motive behind it.

Some Sober variants have displayed neo-Nazi messages, but the latest version of the virus does not do this. However, all Sober variants send German messages to German email addresses and English messages to other addresses.

"The numbers we're now seeing with Sober.Y are just huge," said Mikko Hyppönen, chief research officer at F-Secure. "This is the largest email worm outbreak of the year."