O
ovi
Guest
The 18th variant of the first Sober virus, W32/Sober.r@MM is a mass-mailing worm hiding inside a .ZIP attachment. When run, the worm displays fake error messages, infects the host computer and sends itself to stolen email addresses. Messages may come in German or English.
What should I look for?
FROM: Varies
SUBJECT: English: Your new Password. German: Fwd: Klassentreffen
BODY: English: Your password was successfully changed! Please see the attached file for detailed information. German: ich hoffe jetzt mal das ich endlich die richtige person erwischt habe! ich habe jedenfalls mal unser klassenfoto von damals mit angehngt.
ATTACHMENT: KlassenFoto.zip, pword_change.zip
How do I know if I've been infected?
Fake error messages displayed. Outgoing messages as noted above. Note: Receiving an email alert stating that the virus came from your email address is not necessarily an indication you are infected. Mass-mailing viruses often "spoof" the from address.
What can I do?
Besides keeping your anti-virus protection current, fortify your PC security
Source: McAfee
What should I look for?
FROM: Varies
SUBJECT: English: Your new Password. German: Fwd: Klassentreffen
BODY: English: Your password was successfully changed! Please see the attached file for detailed information. German: ich hoffe jetzt mal das ich endlich die richtige person erwischt habe! ich habe jedenfalls mal unser klassenfoto von damals mit angehngt.
ATTACHMENT: KlassenFoto.zip, pword_change.zip
How do I know if I've been infected?
Fake error messages displayed. Outgoing messages as noted above. Note: Receiving an email alert stating that the virus came from your email address is not necessarily an indication you are infected. Mass-mailing viruses often "spoof" the from address.
What can I do?
Besides keeping your anti-virus protection current, fortify your PC security
Source: McAfee
