The latest Sober worm has infected more than 1,000 Windows  -based machines since it was first identified Monday, and has started showing up on much of the Web.
Sober is far and away the leading virus on the Internet, accounting for 78 percent of all viruses seen by the firm's monitoring stations around the world, according to security firm Sophos.
Security experts said the worm has the insidious ability to delete files related to Symantec's antivirus LiveUpdate feature. However, containment and removal of Sober are not considered difficult.
FIFA Connection
The remarkable quality of this variation of Sober is the text in the subject line of the e-mails it sends.
"Other Sobers have had similar English text," said Sophos analyst Christ Kraft, "but the authors have done some innovation (this time) around the World Cup soccer event."
What is getting so many people to open the e-mail and then the attachment -- which contains the virus -- is an offer to claim free tickets from the international football association FIFA for the 2006 World Cup to be held throughout Germany.
"For the virus writer, it's a clever way to get people to click," Kraft said. "But the business disruption is another thing. It's creating an enormous amount of chatter over enterprise networks."
Sobering Infection
The variation of the new Sober threat is known by different alphabetic identifiers from different antivirus vendors. Computer Associates and Sophos call it "N," Symantec uses "O," McAfee and F-Secure have dubbed it "P," and at Trend Micro the Sober variant is "S."
As e-mail viruses usually do, Sober harvests e-mail addresses from the directories of the machines it infects and resends itself to those addresses.
Antivirus vendors have posted tools on their Web sites to remove the worm.
|
Microsoft Says Battery Woes Not Caused By Windows 7
IBM's New POWER7 Servers Save Energy with Big Loads
'Dead Simple, Dirt Cheap' JooJoo Tablet Shipping Soon
Google May Add Facebook, Twitter Links to Gmail
IBM Opens Eco-Friendly, Cloud-Focused Data Center