Application security

New Sober variants in the mail

Security vendors warned users on Tuesday about a handful of new variants of the Sober worm that have appeared this week.

F-Secure announced that it had found three variants of the worm on Tuesday morning, adding a fourth and fifth later in the day.

The Finnish company said one of the variants, Sober.T, was similar to earlier versions of the worm, sending itself as an email attachment with either German or English text.

"This time the author of the Sober worm changed the encryption algorithm for text strings in the worm's body," the company said on its website. "And he included a message for anti-virus vendors in the worm's body, basically saying, 'Use your debuggers, it's fun.'"

German police authorities warned Monday that a new Sober outbreak was on its way, citing a year-long investigation into the worm, according to F-Secure.

Kaspersky Lab and Symantec also both issued Tuesday warnings for new variants. Symantec named the variant W32.Sober.S@mm, while Moscow-based Kaspersky called the new worms Sober.u, Sober.v, Sober.w and Sober.z.

www.f-secure.com
www.kaspersky.com
www.symantec.com

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.