PDA

View Full Version : Sober-N Worm Shows No Sign Of Retreat


forwardone
05-04-05, 11:47 PM
Sober-N Worm Shows No Sign of Retreat
http://images.newsfactor.com/images/spacer.gif
http://images.cio-today.com/images/id/4199/sober-n-worm-email_cio.jpg May 4, 2005 2:57PM
http://images.newsfactor.com/images/spacer.gif
"One in every 22 emails sent across the internet is currently infected by the Sober-N worm -- making this one of the biggest virus outbreaks of the year," said Graham Cluley, senior technology consultant at Sophos. Experts at SophosLabs, Sophos's global network of virus and spam analysis centers, have warned users that the W32/Sober-N worm has now been reported attempting to break into computer systems in over 40 different countries, and shows no signs of slowing down.

Since the worm first emerged on Monday it has dominated the chart of most commonly encountered viruses. At the time of writing it is accounting for 79.29 percent of all viruses seen by Sophos's monitoring stations around the world. Sophos experts calculate that the worm is now accounting for an astonishing 4.5 percent of all email (legitimate or otherwise) sent across the internet.

"One in every 22 emails sent across the internet is currently infected by the Sober-N worm -- making this one of the biggest virus outbreaks of the year," said Graham Cluley, senior technology consultant for Sophos. "All internet users must secure their systems with up-to-date anti-virus software and ensure that they never open unsolicited email attachments. No-one should be fooled into thinking that email viruses are a thing of the past."

Sophos reports that the worm fooled users into opening its dangerous email attachment by using a variety of tricks -- including using a number of different subject lines and message texts, and sending itself in either German or English language depending on what it suspected was the natural language of the recipient.

"In particular, this worm appears to have caused problems by posing as an offer of free tickets for the soccer World Cup tournament in Germany next year," continued Cluley. "Many people found the prospect of free tickets to the prestigious sporting event just too hard to resist." Sophos recommends companies protect their email with a consolidated solution to thwart the virus and spam threats and secure their desktops and servers with automatically updated anti-virus protection.
Geoff

forwardone
05-18-05, 11:35 AM
It seems yet another variation on a theme has appeared. :mad:

Sober Worm back in the news

Anti-Virus experts have reported that the Sober Worm has become a tool for propaganda with the latest version filling up email boxes around the world with German-language spam. The worm first hit the Internet way back in 2003. And we have till now seen around 20 variants of this worm. The latest version is not designed to spread by itself but just to get a message across.

Last weekend saw thousands of computers infected by a variant of Sober were instructed to download a new version of the program. These computers are currently under the control of the original developer of the worm. The latest variant codenamed Sober-Q turned infected computers into spam machines.

They are sending out hundreds of messages, mostly in German with links to Web pages containing information on conservative German political issues. In fact, some of the links points to legitimate news sources on the Internet related to the concerned issues. Fortunately, the worm is not spreading by itself. Rather only the previously infected computers are being targeted.

The spam mail has more than 70 variants with different messages. Anti-spam technical operations at MessageLabs Stephen White said in a statement: “Almost all of the spam e-mails have been sent from otherwise clean IP addresses and will have gone largely undetected by spam filters. It would seem that the virus author has stored up networks of infected machines around the world, holding them on standby to deploy at specific times.”

Geoff