Infections of W32/Sober.A@mm increase steadily

W32/Sober.A@mm is a bilingual mass mailing worm the infection rate of which has been increasing steadily in the past few days and weeks. Sober.A spreads between Windows systems via e-mail. These e-mails pose as security warnings against a possible new mass mailing worm and carry attachments that are said to be patches against this threat. The attachments, however, are infected with W32/Sober.A@mm.

Once this attachment has been executed Sober.A infects the computer and harvests more e-mail addresses from the infected computer's hard drive. The worm subsequently sends itself to these addresses using its own SMTP engine.

W32/Sober.A arrives in e-mails with subject lines and content either in English or in German. If the Internet domain of the recipient is .de, .at, .ch, or .li, then the message is created in German, otherwise in English.

The e-mail's subject line is then randomly chosen from one of the following:

In German:

Recommended Reactions

Users are advised to update their virus signature files and make sure they have the latest versions of F-Prot Antivirus installed on their computers.

After updating the virus signature files, users should scan their whole system with the F-Prot Antivirus OnDemand scanner to ensure that their computer security was not compromised before the virus signature files were updated.

For more information on this worm and disinfection please visit our virus information section.

Threat Detection

The latest versions of F-Prot Antivirus detects W32/Sober.A@mm using virus signature files dated 28 October 2003 or later.