Sober worm spreads like wildfire

[NFS4]

http://news.zdnet.com/2100-1009_22-5693981.html

 

[imported_Tick]

Special.

 

[Scouzer]

Your subtitle made my eyes bleed.

 

[Jzero]

<Insert standard Jzero comments touting the benefits of rule-based filtering software here.>

 

[hevnsnt]

"The latest Sober offshoot, which has been tagged as Sober.N, Sober.O or Sober.S at other security companies, uses e-mail written in both English and German. One of its lures is a message saying the recipient has won free tickets to the 2006 World Cup soccer tournament."

In otherwords.. The US is safe.

 

[NFS4]

Originally posted by: Jzero
<Insert standard Jzero comments touting the benefits of rule-based filtering software here.>

Actually, I'm using Thunderbird. Thunberbird caught every message and through it into the junk email bin. However, Norton scanned every message before TB got ahold of it and threw the attachments into Quarantine

 

[dmcowen674]

There is two of them.

The other one that came from an old work address from where I worked in Georgia had a different header.

The file was a txt file so I thought they were trying to get in touch with me.

Turns out the file really has hidden characters and it is not a txt file.

I shut down right away and went in Safe Mode and saw what the payload did and removed it right away.

Cute

 

[chrisms]

I dunno man wildfire can spread pretty quick. That's why thet call it "wild" fire. It isn't tame baby

 

[ViRGE]

Why, just why?! Haven't people figured out by now to stop opening random attachments?

 

[MikeMike]

Originally posted by: ViRGE
Why, just why?! Haven't people figured out by now to stop opening random attachments?

we have an elite member who didnt...

MIKE

 

[dmcowen674]

Originally posted by: ViRGE
Why, just why?! Haven't people figured out by now to stop opening random attachments?

If it comes from a legitimate E-mail address (thanks to successful harvesting of E-mail addys) and scanning the file first, it's easy.

I did in fact scan the file first but the Anti-Virus failed to pick up anything while the file was in bogus attachment form.

Later I ran the scan after removing the bogus suffix and the Anti-Virus was able to detect the payload. Very clever these guys indeed.

 

[Toasthead]

Originally posted by: hevnsnt

"The latest Sober offshoot, which has been tagged as Sober.N, Sober.O or Sober.S at other security companies, uses e-mail written in both English and German. One of its lures is a message saying the recipient has won free tickets to the 2006 World Cup soccer tournament."

In otherwords.. The US is safe.

hahahahaha

 

[CPA]

How does 77% equate to 2/3s?

 

[vi edit]

My hotmail account has got hammered by about 400 of them.

All with 73KB .zip attachments.

 

[NFS4]

Originally posted by: Toasthead

Originally posted by: hevnsnt

"The latest Sober offshoot, which has been tagged as Sober.N, Sober.O or Sober.S at other security companies, uses e-mail written in both English and German. One of its lures is a message saying the recipient has won free tickets to the 2006 World Cup soccer tournament."

In otherwords.. The US is safe.

hahahahaha

LOL, I just got the joke

 

[loup garou]

huh? wha? What worm?

(messagelabs rules)

 

[Aquaman]

I've not been sent any

Cheers,
Aquaman

 

[cavemanmoron]

Originally posted by: Scouzer
Your subtitle made my eyes bleed.

Topic Title: Sober worm spreads like wildfire
Topic Summary: I alone has 668 hits today alone on my Anandtech account
Created On: 05/03/2005 05:14 PM

 

[Toastedlightly]

:thumbsup: Quantum!

 

[NFS4]

So far today...

 

[jjones]

Originally posted by: CPA
How does 77% equate to 2/3s?

Fuzzy math?

 

[NathanBWF]

Yeah our mail server has been getting hammered for the last 2 days...

 

[Aquaman]

Originally posted by: NFS4
So far today...

Holy crap :Q

Cheers,
Aquaman

 

[cjgallen]

Variants of Sober have been circulated since 2003 and have continued to hit corporate and home systems.

That's a long time!

Someone should mass email virus killing executables.

 

[FoBoT]

i got one monday. i read about it on the symantec website. i sent out new virus defs to check for it. haven't heard any issues yet.