Subscribe

Sober worm a slow starter?

By Damian Clarkson, ITWeb junior journalist
Johannesburg, 22 Nov 2004

There are mixed views among AV vendors as to whether the latest Sober worm variant could yet cause a few scares on the virus front.

The worm surfaced on Friday as an e-mail attachment that infects users when opened. The worm is then mass mailed to all the addresses it finds on the user`s hard drive. The mail comes in both English and German.

However, the worm prevalence was fairly low, says Brett Myroff, CEO of local Sophos distributor NetXactics.

Ryan Price, executive director at Y3K, says the virus is still lingering, even though it should have tapered off. "Theoretically, the weekend break should have given people enough time to download patches and protect themselves. But the problem is that people are not managing their AV properly."

However, a number of new virus reports have surfaced this morning - some locally - says Justin Stanford, CEO at NOD32 South Africa, who believes the worst may be yet to come. "I would not say it is tapering off. Rather, it is still going to come on strong. The worm did not exactly storm onto the scene," he says.

"We had the virus rated at number five on Friday, but this morning we have it as the number one virus on our list."

Stanford adds that a virus radar Web site has found over 93 000 reports of the virus in the last 24 hours. The noted increase is likely due to the fact that people are returning to work and opening the infected e-mail.

Speaking about the virus itself, Stanford says the messages are too varied to mention, but that subject lines are extremely convincing. "I personally know of a few people that were fooled by one of these messages."

Share