The Sober.O Worm

Posted 9 May 2005

The Sober Worm's has been an irritant for over 18 months, but the latest version has suddenly burst onto the scene. The anti-virus company Message Labs claims nearly 5% of worldwide email traffic was taken up with Sober infected messages on May 6.

The worm itself is a standard mass mailer. It spreads by the victim opening an infected attachment which loads the virus. In turn, the infected machine passes the infection on to every email address it can find. It also appears to disable Norton Antivirus and the Windows XP firewall.

An interesting feature about this virus is one version claims to offer free tickets to the 2006 Soccer World Cup. The most common subject line for the current version is that you have sent an infected mail or a message has been rejected. Either way, there is no reason to run an attachment to open an email warning about these things.

Avoiding this virus is fairly easy. Be sceptical about an email you receive and do not open attachments except from people you know on topics you trust. Make sure your anti-virus is up-to-date and all security patches have been installed on your computer.

More information about the Sober.O worm is available at the Symantec Anti-virus Research Centre