Sober virus on popular European tour

By Matt Whipp

Posted on 29 Oct 2003 at 16:28

The Sober virus - discovered on Monday - now accounts for 50 per cent of reported incidents, warns Sophos, and is continuing its rise throughout the UK and Germany.

Carole Theriault, security consultant at Sophos, said that on Monday, Sober reports accounted for 20 per cent, but that level has now reached 50 per cent.

'It's a fairly obvious worm,' she said, but she had an idea why the virus was still spreading. 'These worms play on computer users' fears and can be difficult to spot with email subject lines and messages chosen at random.'

The subject lines and messages are either in German or English, depending on the domain of the recipient's email address, but Theriault suspected the virus originated in Germany, as the English is so poor, while the German versions are more coherent.

One of the messages praises the writer of the SoBig virus: ''Congratulations!! Your Sobig Worms are very good!!!You are a very good programmer! Yours faithfully Odin alias Anon,' it reads

It spreads by sending itself on to addresses found on the victim's computer, but is not otherwise malicious.

Theriault also warned that without updated antivirus software, the worm can be very difficult to remove.

It installs itself using two files that watch over each other, so if you try to delete one of them, the other automatically reinstalls it. 'You've got to try and stop them both together,' she said, 'which makes it very difficult to delete manually.'

For more information, visit the Sophos website.