Sober.P is a mass-mailing worm that was discovered earlier this afternoon and, as with all Sober worm variants that have previously became common, is spreading quickly, especially in Germany, where the family originates. Unlike previous variants, it is spreading much more quickly among home users than it is corporate users. McAfee, for instance, has upgraded it to Medium risk for home users only. In the past, we've seen Sober spread pretty equally between both classes, heavily relying on international business between the United States and Germany.
Messages containing Sober.P typically follow the usual Sober profile: the message body is in poor English or decent German, with the attachment either suggesting that it originates from the system administrator of the email service or is a friendly joke. The message body, on the other hand, can be one of two things: in German, it involves the apparent suggestion of tickets to a soccer game. The English version promises that “account and password information are attached!“ [sic].
Details
Sober.P was discovered on May 2nd, 2005, with details first published around noon PST. It is a worm that spreads via email. It also terminates a small handful of security programs. The attachment containing Sober.P varies, but is always one of the following: account_info.zip, autoemail-text.zip, LOL.zip, Fifa-Info_Text.zip, mail_info.zip, okTicket-info.zip, our_secret.zip, or _PassWort-Info.zip.
Protection
Updated detections for most antivirus programs should appear within the next 24 hours or so when they have not already. Although some antivirus companies rate this worm as a Medium risk, others do not; this may mean that emergency detections will be issued by some companies, but not others. Infected users should wait for detection files and/or more detailed information and removal information to be published before attempting to remove the worm. Until then, infected users should avoid connecting to the Internet or any open network.
The Gist
Like previous Sober variants, Sober.P is written in poor English and will probably raise red flags among users more experienced with worms. However, since this variant is especially common among home users, unlike previous versions, the infected usergroup may be less likely to know where to look for these red flags. Although it is not an outbreak, Sober.P is still spreading quite rapidly and warning precautions should be taken and antivirus programs updated. Germany and the United States, as well as possibly Australia and Great Britain (if the worm follows previous Sober family members' track) may be hardest hit.
Links
McAfeeHelp Forums - Excellent resource for latest information and updates.
Secunia - Compiles latest descriptions and links.
Trend Micro - An excellent and detailed description with generic removal instructions. Refers to worm as Sober.S.
McAfee - Detailed description with excellent, specific removal instructions.
Symantec - Detialed description, but with no specific removal instructions. Refers to worm as Sober.O.
F-Secure - Detailed description with no removal information.
Sophos - At this time, no information posted.
Posted
May 02 2005, 07:42 PM
by
trafton