New Windows worm alert

29 Oct 2003

It appears the net is to be rocked again by the advent of a new virus worm. The worm, entitled “Sober” emerged at the weekend and has begun multiplying widely across the internet.

According to experts many different versions of Windows are vulnerable to the new virus and the situation has been made worse by the clever way in which the virus tries to trick people to opening the tainted email.

One version of the Sober virus poses as an update from anti-virus software vendors. The worm also tries to hide by using different subject lines in both English and German and by changing the name of the file holding the virus.

The virus sometimes looks like a warning to email users that they are sending out email messages that are infected with the virus. Sober also reuses subject lines seen in older viruses.

It is understood that Sober travels with its own email engine so that it can send itself to any addresses it harvests from computers that it has succeeded in infecting.

The virus is understood to be spreading most widely in Germany but is also starting to turn up in the UK where Message Labs says it has stopped under 3,500 copies of Sober since the weekend.

Operating systems that are vulnerable to the worm attack are Windows 2000, 95, 98, Me, NT Server 2003 and XP.

Once an unsuspecting computer user opens the attached virus, a false error message is displayed that makes the user think that they have avoided infection.

Hidden inside the body of the virus is text that praises the creator of the Sobig worm that spread in August. The Sobig worm was the fastest spreading worm in history with more than 200 million emails sent over the internet by infected computers, causing millions of euros worth of damage.

By John Kennedy