1. Symantec/
  2. Security Response/
  3. W32.Sober.gen


Risk Level 1: Very Low

December 20, 2003
February 13, 2007 12:15:24 PM
Systems Affected:

W32.Sober.gen is a generic detection for a mass-mailing worm that uses its own SMTP engine to spread. The subject of the email varies but has been known to be in either English or German. The email's attachment name also varies, but will commonly have a .bat, .com, .cmd, .exe, .pif, or .scr file extension.

The first time W32.Sober.gen is activated, it displays a cryptic fake error message and then appears to exit.

This threat is written in the Microsoft Visual Basic programming language.

If your computer is detected as infected with W32.Sober.gen, download and run the removal tool. In most cases, it will be able to remove the infection.

Antivirus Protection Dates

  • Initial Rapid Release version December 20, 2003
  • Latest Rapid Release version November 30, 2016 revision 032
  • Initial Daily Certified version December 20, 2003 revision 002
  • Latest Daily Certified version December 1, 2016 revision 001
  • Initial Weekly Certified release date December 20, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Atli Gudmundsson
Summary| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube