A new Sober mass-mailed worm debuted over the weekend and is picking up steam, causing several anti-virus vendors to boost their threat ranking.
Security firms in the US said Sober.C, following hard on the heels of Sober.B, which appeared last week, has hit Germany particularly hard.
Packed with its own SMTP mailing engine, the worm includes a file attachment -- which can come with any of several file names -- that when opened puts up a bogus error message on Microsoft Windows machines.
The worm harvests e-mail addresses from compromised machines and re-mails itself to those addresses. These secondary e-mails can come with subject headings -- both in English and German -- such as 'Your IP was logged' and 'Testen Sie irhen IQ'.
MessageLabs, a UK-based message filtering vendor, reported that more than 80 percent of the Sober.C worm samples it intercepted originated from Germany, but warned users that it may spread to other regions, including the US.
Network Associates raised its threat ranking of Sober.C to 'medium' on Monday in response to the spreading worm. Security vendor Symantec tags the worm as a level two threat in its five-point rating system.
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
