From: McAfee
Date: 10/07/05 14:34:10
Subject: VIRUS ADVISORY: W32/Sober.r@MM
CURRENT THREAT W32/Sober.r@MM
Medium Risk
DAT Required: 4598
Virus Advisory
What is it?
The 18th variant of the first Sober virus, W32/Sober.r@MM is a mass-mailing worm hiding inside a .ZIP attachment. When run, the worm displays fake error messages, infects the host computer and sends itself to stolen email addresses. Messages may come in German or English.
What should I look for?
FROM: Varies
SUBJECT: English: Your new Password. German: Fwd: Klassentreffen
BODY: English: Your password was successfully changed! Please see the attached file for detailed information. German: ich hoffe jetzt mal das ich endlich die richtige person erwischt habe! ich habe jedenfalls mal unser klassenfoto von damals mit angehngt.
ATTACHMENT: KlassenFoto.zip, pword_change.zip
How do I know if I've been infected?
Fake error messages displayed. Outgoing messages as noted above. Note: Receiving an email alert stating that the virus came from your email address is not necessarily an indication you are infected. Mass-mailing viruses often "spoof" the from address.
What can I do?
Besides keeping your anti-virus protection current, fortify your PC security by installing McAfee Personal Firewall Plus — recommended against threats like W32/Sober.r@MM that need Internet access to spread.
--------------------------------------------------------------------------------
Date: 10/07/05 14:34:10
Subject: VIRUS ADVISORY: W32/Sober.r@MM
CURRENT THREAT W32/Sober.r@MM
Medium Risk
DAT Required: 4598
Virus Advisory
What is it?
The 18th variant of the first Sober virus, W32/Sober.r@MM is a mass-mailing worm hiding inside a .ZIP attachment. When run, the worm displays fake error messages, infects the host computer and sends itself to stolen email addresses. Messages may come in German or English.
What should I look for?
FROM: Varies
SUBJECT: English: Your new Password. German: Fwd: Klassentreffen
BODY: English: Your password was successfully changed! Please see the attached file for detailed information. German: ich hoffe jetzt mal das ich endlich die richtige person erwischt habe! ich habe jedenfalls mal unser klassenfoto von damals mit angehngt.
ATTACHMENT: KlassenFoto.zip, pword_change.zip
How do I know if I've been infected?
Fake error messages displayed. Outgoing messages as noted above. Note: Receiving an email alert stating that the virus came from your email address is not necessarily an indication you are infected. Mass-mailing viruses often "spoof" the from address.
What can I do?
Besides keeping your anti-virus protection current, fortify your PC security by installing McAfee Personal Firewall Plus — recommended against threats like W32/Sober.r@MM that need Internet access to spread.
--------------------------------------------------------------------------------
Last edited:
