Sober variant set to cause trouble

Antivirus firm Network Associates today raised to 'medium' its risk assessment of the recently discovered Windows worm Sober.f.

Sober.f is a prolific worm that spreads via email, sending itself to addresses found on the victim's machine.

The worm has many of the same functionalities as its predecessors: it comes in the form of an attachment and contains a varying filename.

Users need to manually run the attachment in order to be infected.

After executing, Sober.f emails itself out as an attachment with a random filename and installs itself to the victim machine's system directory using a filename constructed from a string pool carried within the worm.

Sober.f, which is reported to be difficult to find and hides from many antivirus scanners, was first reported to researchers earlier today. To date, Network Associates has received more than 100 reports of the virus in the wild.

Further information on the worm and instructions for its removal are available from Network Associates here.

Further reading

• Security

New worm masquerades as Microsoft update

• 08 Mar 2004

• Security

Sober worm about to cause major hangover

• 19 Nov 2004

• Security

Alert level raised on latest sober mutant

• 19 Apr 2005

• Security

Worms still number one security threat

• 03 Mar 2004

• Security

F-Secure warns on software flaw

• 06 Apr 2004

• Tweet  
• Facebook  
•  
•  
• Send to  

• Topics
• Security