Kaspersky Lab's virus analysts have detected three new variants of Email-Worm.Win32.Sober - Sober.u, Sober.v and Sober.w.
The three worms are modifications of the same program, which has been repacked, the company says in a statement.
"A large number of samples have been intercepted in mail traffic, which confirms that the epidemic was caused by mass spamming of infected messages," it says.
Kaspersky says the new variants of Sober arrive as an attachment to infected messages.
The attachment, which contains the body of the worm, is about 130KB in size. Although infected messages either have a random subject and text, or no subject or text at all, they can be recognised by the attachment name.
The attachment names are chosen from the following: Exceltab-packed_List.exe, Liste.zip, Reg-List-Dat_Packer2.exe, reg_text.zip, Word-Text.zip, Word-Text_packedList.exe or Word-Text_packedList.zip.
"The worm is only activated if the recipient clicks on the attachment," Kaspersky states, adding that, once launched, the worm causes a false error message "WinZip Self-Extractor. WinZip_Data_Module is missing -Error" to be displayed on screen.
The new variants of Sober copy themselves to the Windows system directory, and then register these files in the system registry. This ensures a copy of the worm will be launched each time Windows is rebooted on the infected machine.
Kaspersky says that in order to propagate, the worm sends itself to e-mail addresses harvested from the victim machine. Users are encouraged to be cautious, and not to open suspicious-looking e-mail or attachments.
Share
