1. /
  2. Security Response/
  3. W32.Sober.I@mm

W32.Sober.I@mm

Risk Level 2: Low

Discovered:
November 19, 2004
Updated:
February 13, 2007 12:30:07 PM
Also Known As:
Win32.Sober.I [Computer Associ, Sober.I [F-Secure], I-Worm.Sober.i [Kaspersky], W32/Sober.j@MM [McAfee], W32/Sober.I@mm [Norman], W32/Sober.I.worm [Panda], W32/Sober-I [Sophos], WORM_SOBER.I [Trend]
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

W32.Sober.I@mm is a mass-mailing worm that uses its own SMTP engine to spread by sending itself as an email attachment to the addresses gathered from the infected computer.

The subject of the email varies and will be in either English or German. The email sender address is spoofed. The name of the email attachment varies and has a .bat, .com, .pif, .scr, or .zip extension. The attachment may also have a double file extension.

This threat is written in the Microsoft Visual Basic programming language and is compressed with UPX.

Notes:
  • Live Update definitions version 61119c (extended version 11/19/2004 rev. 3) or greater will detect this threat.
  • In certain circumstances the worm may corrupt itself. If this happens the worm will not execute on the computer and antivirus software may not be able to detect it. A computer is infected with a corrupt version of W32.Sober.I@mm may display Command Prompt windows when Windows starts.
  • The W32.Sober@mm Removal Tool will not be able to uninstall corrupt versions of W32.Sober.I@mm. Use the manual removal instructions listed below in these cases.


Antivirus Protection Dates

  • Initial Rapid Release version November 19, 2004
  • Latest Rapid Release version September 12, 2012 revision 032
  • Initial Daily Certified version November 19, 2004
  • Latest Daily Certified version September 12, 2012 revision 036
  • Initial Weekly Certified release date November 19, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: More than 1000
  • Number of Sites: More than 10
  • Geographical Distribution: Medium
  • Threat Containment: Easy
  • Removal: Moderate

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: High
Writeup By: Candid Wueest

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver