Sober.P New Heights

Hey,

From Bullguard

The Sober.P worm is circulating the Internet in greater quantities than ever, surprising experts with its continued growth, ZDNet UK reports. http://news.zdnet.co.uk/internet/security/0,39020375,39197760,00.htm

Antivirus company Sophos reported on Monday that the mass-mailing worm now accounts for 5.4 percent of all email and 84 percent of virus activity that the company saw over the weekend. That has risen from Friday's figures, which were 4.65 percent of all email and 77 percent of virus activity.

"The strange thing is that we're actually seeing more reports than ever," said Graham Cluley from Sophos. "We don’t know how many people are infected, but those infected are just spewing these emails out."

Cluley said that the second most prevalent virus, Netsky.P, accounted for 0.3 percent of all email viruses, and Zafi.D, the third most popular worm, was just 0.082 percent. "Those have been big viruses, but have been dwarfed by the Sober worm," he said.

Click here to read the full story. http://news.zdnet.co.uk/internet/security/0,39020375,39197760,00.htm

Click here to read our information on the Sober.P/Sober.O worm. http://www.bullguard.com/virus/default.aspx?id=333

Bertha

"In the meantime Sober.q has become active, instead of sending copies it's sending spam messages now."

Info here.

Hey,

From Bullguard

Another variant of the Sober worm, which spreads right-wing messages in German and English, appeared over the weekend. Security firms are warning that they have received hundreds of thousands of emails generated by the new variant - Sober.Q - in its first 24 hours, ZDNet Australia reports.
http://www.zdnet.com.au/news/security/0 ... 987,00.htm

Sober.Q started its spreading in the same week that Germany and Europe celebrated the 60th anniversary of the end of World War II in Europe and the latest variant's sole purpose seems to be to distribute hate mail. Sober is usually a mass-mailing worm that sends a copy of itself to e-mail addresses stored on an infected computer's hard drive.

"Sober.Q appears to be downloaded by machines infected by Sober.P… If this is the case, the Sober.P author or authors could have remote command-and-control capabilities over a large network of infected machines. This network would provide not only a megaphone to distribute messages of hate, but a platform for future spam, worm and DoS attacks,' said Scott Chasin, chief technology officer at email security specialists MX Logic.

MX Logic's Threat Centre has reported seeing more than 125,000 instances of the Sober.Q worm and categorised it as a high severity threat.

Click here to read the full story. http://www.zdnet.com.au/news/security/0 ... 987,00.htm

Bertha

"Zombie PCs infected with the Sober-P worm are set to reactivate on Monday, 23 May. Sober-P posed as offers of a free ticket for next year's World Cup and set up backdoor access on compromised PCs, claiming thousands of victims since its first appearance earlier this month."

Full story here.