W32.Sober.X@mm

W32.Sober.X@mm is a mass-mailing worm that uses its own SMTP engine to spread and lowers security settings. It sends itself as an email attachment to addresses gathered from the compromised computer. The email may be in either English or German.


Note: Symantec products that support the Worm Blocking functionality automatically detect this threat as it attempts to spread.

Protection

• Initial Rapid Release version November 19, 2005
• Latest Rapid Release version January 16, 2009 revision 048
• Initial Daily Certified version November 19, 2005
• Latest Daily Certified version January 16, 2009 revision 050
• Initial Weekly Certified release date November 22, 2005

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High