New worm masquerades as Microsoft update

A new variant of the Sober worm has surfaced this morning, antivirus specialist F-Secure has warned.

Sober D pretends to be a Microsoft software update that protects against a new version of the MyDoom worm.

Once activated the worm displays a patch loading screen, but harvests email addresses and mails itself out using its own SMTP engine.

The email, written in either English or German, has the headline 'Microsoft alert: please read!' The body text adds: 'New MyDoom virus variant detected - please download this digitally signed attachment.'

Paul Bushen, technical manager at F-Secure UK, told vnunet.com: "The social engineering is good enough to do the job of fooling people.

"People are not learning quickly that Microsoft does not send out emails like this.

"It's like remembering to back up your hard drive regularly: something that's done religiously, but only by those who've been caught out in the past."

Sober A first surfaced in October 2003, again using either English or German text and a variety of social engineering techniques.

The virus has previously been disguised as a Microsoft email and as one from the Recording Industry Association of America.

See also:

Sober variant set to cause trouble

Heightened risk assessment for Sober.f strain spotted in the wild  05 Apr 2004

Network Box of tricks to target viruses

Supplier seeks resellers for remotely managed hardware aimed at SMEs  15 Mar 2004

Virus war of words falls silent

Netsky and Bagel variants continue to spring up, but virus writers' slanging match cools down  09 Mar 2004

Worms still number one security threat

MyDoom.A and Sober C lead the pack, Bagel and Netsky catching up fast  03 Mar 2004

Sober judgement for virus writers

Multi-lingual W32/Sober-A worm causes most problems in November  02 Dec 2003

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!