New version of the Sober worm masquerades as Microsoft update - Computerworld

The virus storm continues. The Sober worm is back with a new trick to try to fool you. Repeat after me: "Microsoft never sends patches by e-mail." Update your anti-virus and delete any of these messages that might have slipped through.

New version of the Sober worm masquerades as Microsoft update - Computerworld

Sober.D is the latest version of a worm that first appeared in October
News Story by Paul Roberts

MARCH 08, 2004 (IDG NEWS SERVICE) - Antivirus software companies warned customers about a new variant of the Sober e-mail worm that began spreading on the Internet today and masquerades as a Microsoft Corp. software update.

Sober.D is the latest version of a worm that first appeared in October. The new worm poses as a software patch that will remove the MyDoom virus from infected Windows systems, said antivirus company F-Secure Corp. in Helsinki, Finland.

F-Secure first detected the new worm variant in Germany early today. The company rated the virus a 'Level 2' threat, indicating 'large infections,' the company said.

Like its predecessors, Sober.D spreads by skimming e-mail addresses from victims' computers, then mailing copies of itself to those addresses. Sober.D also adapts its message for German-speaking audiences, inserting a German-language version of its pitch message into e-mail addresses belonging to German domains, such as those ending in .de, F-Secure said.