A Smattering of Sobers

It's not often we get prior warning of worms spreading.  But yesterday, German officials warned that we would see a new Sober variant using the attachment names “Word Text.zip” or “registration.zip” and, sure enough, we have Sober.V.  Unfortunately, on the same day, we also have Sober.S, Sober.T, and a fairly minor variant, Sober.U.  Although none are spreading extremely rapidly, both have been reported in the United States, Germany, and several other countries.

An article from About.com is available here.  Amusingly, as the article points out, antivirus vendor Trend Micro published a description for the worm (as WORM_SOBER.AD) before it was released - and dubbed it as in the wild!  Impressive forethought, indeed.

Users should be careful with any executables or files that can contain executables (like .zips), of course.  Conventional common sense is the key to avoid infection with worms like Sober.  Filenames associated with these threats are reg_text.zip (Sober.S), excel_table.zip (Sober.T), tabelle.zip (Sober.T), registration.zip (Sober.V), and Word-Text.zip (Sober.V).