SHARE
Facebook X Pinterest WhatsApp

New Sober Worm on the Loose

A new version of the Sober worm appeared on the Internet early Friday morning and already it is having quite a bit of success infecting users in Europe through the use of social engineering. Sober.J arrives in an e-mail message that appears to be a returned-mail error message, telling the user that an e-mail sent […]

Written By
thumbnail Dennis Fisher
Dennis Fisher
Nov 19, 2004
Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

A new version of the Sober worm appeared on the Internet early Friday morning and already it is having quite a bit of success infecting users in Europe through the use of social engineering.

Sober.J arrives in an e-mail message that appears to be a returned-mail error message, telling the user that an e-mail sent earlier has bounced. The message typically contains a .zip, .bat, .com, .scr or .pif attachment and a body text that is some variation on the following:

This mail was generated automatically.More info about –YAHOO– under:
http://www.yahoo.com——-
Occured_Errors:178.218.194.86_
does_not_like_recipient.#
185:
MAILBOX NOT FOUND# 144:
Giving_up_on_178.218.194.86.# 533:
This_account_has_been_discontinued_
[#413].End——-
The original mail is
attached.Auto_Mail.System: [yahoo]

The subject line of the e-mail message varies, but often indicates that the message is a warning about a bounced e-mail, such as:

Delivery_failure_notice

Faulty_mail delivery

Mail_delivery failed

When the recipient opens the attachment, the worm displays a fake error message saying that a portion of the WinZip software is missing. The worm then copies itself to the Windows System folder in two separate locations, using filenames that it constructs dynamically from a small set of common strings, including sys, spool, crypt, host, dir, service, win, run, 32, data, and a few others, according to an analysis by McAfee Inc., based in Santa Clara, Calif. The filename always ends in “exe.”

Sober.J then creates several registry keys to ensure it will be run on startup and searches for e-mail addresses on the infected machine. It then begins mailing itself to all of the addresses it finds.

Check out eWEEK.com’s for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer’s Weblog.

Recommended for you...

Caylent Research on Database Migrations: What to Know
Victoria Durgin
Aug 28, 2025
Exterro Debuts Agentic AI Tools for Data Risk and E-Discovery 
Jordan Smith
Aug 26, 2025
Multi-OEM Strategies & More Key to Infrastructure in AI Era
Victoria Durgin
Aug 26, 2025
Kendra Krause on New Role at ThreatDown & Channel Goals
Victoria Durgin
Aug 25, 2025
Channel Insider Logo

Channel Insider combines news and technology recommendations to keep channel partners, value-added resellers, IT solution providers, MSPs, and SaaS providers informed on the changing IT landscape. These resources provide product comparisons, in-depth analysis of vendors, and interviews with subject matter experts to provide vendors with critical information for their operations.

Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.