Media releases are provided as is by companies and have not been edited or checked for accuracy. Any queries should be directed to the company itself.

New mass mailing Sober.L worm spreading via email - over 38,000 copies intercepted

  • 22 February, 2005 09:01

<p>MessageLabs, the leading provider of email security and management services to businesses, is warning computer users to be on their guard against a new variant of the mass mailing Sober email worm, W32.Sober.L-mm. MessageLabs has intercepted over 38,000 copies by 8.30am EST today. The first copy was intercepted on 21 February 2005 at 05:01 GMT, originating in Germany, with detections also in France, the US and UK to date.</p>
<p>W32.Sober.L-mm is a mass-mailing worm that sends itself as an attachment and creates random subject lines and body texts in either English or German, depending on the harvested addresses identified by the worm.</p>
<p>The worm is also capable of showing a notice from anti-virus vendors warning about a new version of the virus itself in an attempt to dupe users into clicking on the attachment to download a patch against the virus.</p>
<p>Computer users who activate file attached in the email invoke the virus, which harvests email addresses it finds on the computer's hard drive. The virus then forwards itself onto the list of email addresses it has discovered in infected computers, sending itself in the form of an English or German language message.</p>
<p>Email characteristics:</p>
<p>Subject lines (others possible): “Alert! New Sober worm”, “Paris Hilton Sex Videos”, “You visit illegal websites” and “Your new Password”.</p>
<p>Body Text (others possible):
Antivirus vendors are warning of a new variant of the "Sober" virus discovered today that can delete the hard disk.</p>
<p>Protection: Download and read the zipped patch. It's very easy to install!
Thanks for your cooperation!</p>
<p>Damage: Once activated, W32/Sober.L-mm drops several copies of executable files onto an infected computer with filenames csrss.exe, winlogon.exe and smss.exe.</p>
<p>The worm modifies the registry key Software\Microsoft\Windows\CurrentVersion\Run so that it executes on startup. It then displays the contents of the file systemdrive%/windows/temp/doc_data-text.txt in notepad.</p>
<p>Detection: MessageLabs detected this virus proactively, using its unique and patented Skeptic™ predictive heuristics technology.
For further information, please visit the MessageLabs website at:</p>
<p>About MessageLabs</p>
<p>MessageLabs is the world's leading provider of email security and management services with more than 10,000 clients and offices in eight countries. For more information, please visit</p>

Most Popular

Brand Post

Most Popular Reviews

Join the newsletter!

Error: Please check your email address.

Latest Articles


PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?