Sober worm variant makes the rounds

Advertisement (Why?)

A new variant of the mass-mailing Sober worm has been discovered and is spreading among consumer PC users.

Sober.P, which operates in a similar fashion to other Sober worms, uses a subject header in an e-mail to try to entice people into opening an attachment. The virus then harvests e-mail addresses from the victim and directs a barrage of spam to those addresses.

"The social engineering has been very effective," said Craig Schmugar, virus research manager for McAfee Avert. "They will use German messages for German Windows users. They tell them they've won tickets to the World Cup, and that has been an effective (ploy) for that region."

View: W32/Sober Report @ McAfee

View: W32/Sober Report @ Symantec

Download: Symantec W32/Sober Removal Tool

News source: News.com

Save drafts locally - save entries that you're working on to your local hard drive
One button posting - send any of your drafts to the server with one button click
Edit multiple drafts simultaneously - a tabbed interface allows multiple drafts to be open at the same time
Multiple categories per post - select more than one category for each draft published to the server
Standard tag support - add bold, italics, underline, and URL tags via tool bar, menu, or keyboard
Shell checking support - built in spell checking module underlines misspelled words in red
Download existing posts - download the title and entry of existing blog enties from your server and store it on your hard drive for linking and editing
Edit server-based posts - download server-based entries, edit them, and then upload the changes to the server
Sync-able links list - advanced download techniques will always minimize data request for new published posts
Sync-able categories list - pull an updated category list from your server at anytime
Sync-able text filters list - apply existing server based text filters for drafts
MT specific creation - use MT's extended fields, such as publishing status, categories, and excerpts
Integrated Preview - built in Previewing allows you to view your drafts based on an HTML template
Upload Images - upload any of your local images to anywhere within your blog
RSS Aggregator integration - start new Blog entries from the most popular RSS Aggregator applications
MP3 Player integration - add "now playing" information into Drafts with WMP9's blogging plug-in
Favorites integration - list of Favorites from IE available as insertable links
Customizable tag support - change the tags generated for bold, underline, italics and ten custom tags
Customizable toolbar images - change the look of SharpMT by changing two images
Shell integration - double-clicking a draft file will open it in a SharpMT window
Bookmarklet support - any URL that starts with sharpmt:// will be inserted into a new blog draft
Updated UI - using the minimizing, docking and floating window suppose of .NET 2.0 for a modern interface
Help system - a standard Windows based help system with comprehensive and detailed documentation
Extendable interface - developers can add their own Plug-In by supporting the ISharpMTExtension

SharpMT is Donation-ware and requires the 2.0 Beta 2 version of the .NET Framework to run on a Windows-based PC.

#1 markjensen on 03 May 2005 - 15:09

It seems to me that due in part to (some) users getting smarter and using updated protection, plus not clicking on everything sent to them, combined with the improved security in XP SP2 that these worms/viruses are still getting created and sent out, but they just lack the impact that they used to have.

#2 Gowcra on 03 May 2005 - 15:48

uh no, lets see which stupid pc users fall for it this time

:waits patiently:

#3 Headcase2 on 03 May 2005 - 16:58

My office is getting flooded with this variant the past two days. At first our scanner didn't pick it up, but I knew it wasn't kosher. Had to warn everybody yesterday.

Today the scanner detects and removes the payload, but I'm noticing we are still getting a lot more spam this week than last.

Another trick they've started using:
They add this to the end of the message (COMPANYNAME replaced of course). Just another way to suck in the gullible.

*** Attachment-Scanner: Status OK
*** "COMPANYNAME" Anti-Virus
*** http://www.COMPANYNAME.com

SIDE NOTE: Why does the Symantec Removal Tool not mention this variant?

#4 nvizible on 03 May 2005 - 17:49

ummm... and people actually fall for such things?

#5 IGx89 on 03 May 2005 - 17:55

I normally get 10-20 junk e-mails per day on my 6-year-old Hotmail account, but starting yesterday I've been getting ~20 per hour, 95% being this new worm. Probably because of all the attachments, Hotmail takes 30-60 seconds to empty my junkmail folder every couple hours

#6 Ficman on 03 May 2005 - 20:56

We're seeing a MAJOR increase on our Barracuda Spam filter on this one... This is a nasty one kiddies...

#7 ariel on 03 May 2005 - 21:01

Don’t you have to actually run this in order to get infected?

#8 Skyfrog on 03 May 2005 - 21:30

QUOTE

entice people into opening an attachment.

To think that after all these years people still fall for fake subject lines and open attachments, and from total strangers no less. It boggles the mind...

#9 stromo on 04 May 2005 - 07:36

This worm is a major pain, we are getting about 500 messages every few hours at the moment, poor poor server

#10 Fancymay on 04 May 2005 - 12:40

[COLOR=purple][SIZE=1]
I got 2 messages from service@aol.com containing the virus.

(1 reply) #11 The Darknight on 04 May 2005 - 22:52

So this is the latest Windows Virus batch!

The Virus/Windows Update game continues!

#11.1 PCyr on 05 May 2005 - 20:46

The trolling continues!

#12 OCedHrt on 15 May 2005 - 09:20

Sigh. My dad wants to uninstall the anti-virus because it says there's a virus when he opens attachments. I simply can't convince him that people would send him viruses.

#13 digitalslacker on 15 May 2005 - 13:37

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net