SI
SI
discoversearch

We've detected that you're using an ad content blocking browser plug-in or feature. Ads provide a critical source of revenue to the continued operation of Silicon Investor.  We ask that you disable ad blocking while on Silicon Investor in the best interests of our community.  If you are not using an ad blocker but are still receiving this message, make sure your browser's tracking protection is set to the 'standard' level.
Pastimes : Computer Learning -- Ignore unavailable to you. Want to Upgrade?


To: appro who wrote (46138)5/2/2005 8:00:44 PM
From: Raptech  Read Replies (1) | Respond to of 110631
 
A new Worm has been discovered today (May 2, 2005) named W32.Sober and it’s spreading rapidly! This mass-mailing worm circulates via email using its own SMTP engine to spread and may be in English or German.



Look for the following subject lines, message bodies and attachment names, which are indicative of this worm:



Subject Line: (One of the following)

Re:Your Password
Re:Registration Confirmation
Re:Your email was blocked
Re:mailing error
Re: [blank]
Message Body: (One of the following)

ok ok ok,,,,, here is it
Account and Password Information are attached!
Visit: http:/ /www.[random domain]
This is an automatically generated E-Mail Delivery Status Notification.
Mail-Header, Mail-Body and Error Description are attached

Appends one of the following randomly to the bottom of the message:
Attachment-Scanner: Status OK
AntiVirus: No Virus found
Server-AntiVirus: No Virus (Clean)
http:/ / www.[random domain]


Attachment: (One of the following)



our_secret.zip
mail_info.zip
error-mail_info.zip
account_info.zip
account_info-text.zip

Rap