A new variant of the Sober e-mail worm is still spreading on the Internet, but at a much slower rate than on Monday when it was the most prevalent worm on the ‘Net.
The worm was first discovered on Monday at about 9 a.m. Pacific time, according to McAfee Inc., a vendor of antivirus products. McAfee rates the worm “medium” risk for home users, but sees less risk for corporate users, said Craig Schmugar, a virus research manager at the Santa Clara, California-based company.
McAfee has dubbed this Sober variant Sober.P. “It may very well be the most prevalent variant to date. They keep getting a little bit worse in terms of prevalence,” Schmugar said. In the first three hours of infection, McAfee’s online virus scanning tool helped 8,000 users remove the new Sober variant, he said.
The worm tricks users into opening attachments with messages in both English and German. The worm uses different messages randomly and picks a language based on the operating system language. One of the German messages promises free tickets to the 2006 World Cup soccer in Germany, according to McAfee.
The attached file is a .zip archive. An error message is displayed when a user opens the file. The worm then harvests e-mail addresses from the victim’s PC and sends itself to those addresses. The worm does no damage other than forwarding itself, which can potentially clog e-mail systems and slow down an infected PC, Schmugar said.
The original Sober worm appeared in October 2003. Since then many variants have hit the Internet. All the Sober variants spread mostly in Germany and the U.S. and most tend to peak in the first day, after which the spread rate drops, according to Schmugar.
Users are advised to update their antivirus software to keep the definition files current.