A new variant of the Sober e-mail worm is still spreading on the Internet, but at a much slower rate than on Monday when it was the most prevalent worm on the Net.
The worm was first discovered on Monday at about 9 a.m. Pacific time, according to McAfee, a maker of antivirus products. McAfee rates the worm a "medium" risk for home users, but sees less risk for corporate users, said Craig Schmugar, a virus research manager at the Santa Clara, California-based company.
McAfee has dubbed this Sober variant Sober.P. "It may very well be the most prevalent variant to date. They keep getting a little bit worse in terms of prevalence," Schmugar said. In the first three hours of infection, McAfee's online virus scanning tool helped 8000 users remove the new Sober variant, he said.
Tricky
The worm tricks users into opening attachments with messages in both English and German. It uses different messages randomly and picks a language based on the operating system language. One of the German messages promises free tickets to the 2006 World Cup soccer in Germany, according to McAfee.
The attached file is a .zip archive. An error message is displayed when a user opens the file. The worm then harvests e-mail addresses from the victim's PC and sends itself to those addresses. The worm does no damage other than forwarding itself, which can potentially clog e-mail systems and slow down an infected PC, Schmugar said.
The original Sober worm appeared in October 2003. Since then many variants have hit the Internet. All the Sober variants spread mostly in Germany and the United States, and most tend to peak in the first day, after which the spread rate drops, according to Schmugar.
Users are advised to update their antivirus software to keep the definition files current.
Ad Choices