EmailEmail
PrintPrint
Worry Watch: Outlook e-mail virus Sober-ing
Saturday, May 07, 2005

Antivirus companies are concentrating heavily on the Sober.V computer worm this week, warning users of Microsoft Outlook just how fast this threat can spread to thousands of computers.

 
 
WEEKLY REPORTS

Solutions, Prevention & Remedies

Top 10 Threats

   
 

According to Panda Software, the number of computers infected by Sober.V increased by more than 500 percent over the past week.

As a so-called worm, the virus infects your computer by way of e-mail attachment and self replicates onto additional disks, computers or networks.

Using subject lines such as "mailing error" or "your password," the virus tricks the user into opening the attached file. After the file is downloaded and run, it will display a phony message, reading, "Error: CRC not complete." The virus will then send itself to the e-mail addresses you have stored in Microsoft Outlook.

There are steps that you can take to keep Sober.V from spreading further. Be sure that your virus protection is up to date and be cautious of the messages you receive from both users who are unfamiliar to you and your contacts.

Worry Watch Plus Online only:

Virus Protection and Prevention Resources:
Panda ActiveScan

Symantec


How to delete and block messages from Sober.V in Microsoft Outlook:
Users of Microsoft Outlook can create a rule using the Rules Wizard to automatically delete Sober.V messages when they match certain criteria. The following instructions, provided by Tim Rozgonyi of the Post-Gazette, will work for Outlook 2000. Please be aware that infected messages may still land in your inbox. Other precautions should still be taken.

1. While looking at your Inbox, go to the Tools menu and choose Rules Wizard.

2. Click once on the button in the upper right-hand corner which is labeled New.

3. Click Next.

4. Click once on the box next to "with specific words in the subject."

5. Click once in the bottom window where it says "specific words."

6. Type "mailing error" (without quotes) into the area that says Add new:

7. Click the Add button.

8. Repeat the previous two steps for the following phrases (without quotes), "registration confirmation," "your email was blocked," and "your password."

9. Click OK.

10. Click Next.

11. Click once on the box next to "delete it." (Do not choose to "permanently delete it.")

12. Click Finish.

13. Click New.

14. Click Next.

15. Scroll down and click once on the box next to "with specific words in the body."

16. Click once in the bottom window where it says "specific words."

17. Type "ok ok ok,,,,, here is it" (without the quotes) into the area that says Add new:

18. Click the Add button.

19. Click OK.

20. Click Next.

21. Click once on the box next to where it says "delete it."

22. Click Finish.

23. Click OK.

Solutions, Prevention & Remedies*: Microsoft?s Latest Security Releases
Name Number For Users of Priority
Security Update KB893066 -

http://support.microsoft.com/kb/893066

Windows 2000, XP* Critical
Cumulative Security Update for Internet Explorer KB890923 -

http://support.microsoft.com/kb/890923

Multiple Internet Explorer versions for Windows 98, 2000, ME, XP* Critical
Security Update KB893086 -

http://support.microsoft.com/kb/893086

Windows 2000, XP* Important
Security Update KB890859 -

http://support.microsoft.com/kb/890859

Windows 2000, XP* Important
Security Update KB892944 -

http://support.microsoft.com/kb/892944

Windows 2000, XP (SP1)* Important
Windows Malicious Software Removal Tool KB890830 -

http://www.microsoft.com/malwareremove

Windows 2000, XP*

Go back

* Reading: Solutions, Prevention & Remedies
Additional summary information related to a specific type of solution or prevention that you should be considering. Depending upon the week, this section may have:
• Recent Windows security releases from Microsoft
• Recent updates to widely used anti-spyware programs
• Recent updates to widely used anti-virus programs
• Recent updates to other security programs & devices (ex: Firewalls, routers)
• Recent updates to various applications in wide use


Top 10 Threats:
Name Type Affects Alert Level
Sober.V

MORE

Worm Windows 95, 98, 2000, ME, NT, XP* High
Agent.PF

MORE

Trojan Windows 95, 98, 2000, ME, NT, XP* Medium
Downloader.BSU

MORE

Trojan Windows 95, 98, 2000, ME, NT, XP* Medium
Downloader.BYZ

 MORE

Trojan Windows 95, 98, 2000, ME, NT, XP* High
Qhost.AF

MORE

Trojan Windows 95, 98, 2000, ME, NT, XP High
Shinwow.E

MORE

Trojan Windows 95, 98, 2000, ME, NT, XP* Medium
Mhtredir.gen

MORE

Trojan Windows 95, 98, 2000, ME, NT, XP* Medium
Clicker.CY

MORE

Trojan Windows 95, 98, 2000, ME, NT, XP Medium
Netsky.P

MORE

Worm Windows 95, 98, 2000, ME, NT, XP* High
Sdbot.ftp

MORE

Worm Windows 95, 98, 2000, ME, NT, XP Medium

Go back

Read: Top Threats
These are viruses that are currently on the watch lists of major anti-virus software companies.

Name
What the threat is called. We use the name given each virus by Panda Software. Sometimes other anti-virus companies give the same threat a different name. Usually they use similar names.

Type
There are different characteristics associated with different types of threats.
• Virus - has the ability to replicate or infect computers or other programs
• Trojan Horse (or Trojan) - appear to be harmless programs when you get them. They unleash their payload when you double-click, open, or execute them.
• Phishing - a Web site or e-maill message posing as another company - usually one you know to fool you into giving the sender personal information.
• Worm - self replicates onto additional disks, computers or networks
• Spyware - installs on your system to collect information about your activity, preferences or interests
• Hoax - false messages sent by e-maill to mislead the recipient
• Backdoors - opens a security hole that allows outsiders to take control of your computer
• Dialer - uses your telephone to dial an outside number - sometimes a number that costs you money when dialed

Affects
Not all viruses affect all types of systems. Some, for example may affect only Windows 98 and 95, but not Windows XP or NT. Others affect all Windows systems, but not Macintosh. In this column, we show you the consumer systems that the threat is known to affect. We don't always include the servers that operate in your company's backroom.

Alert level
The level of awareness that anti-virus vendors suggest you need to have for each threat listed.
For each threat listed, we'll post a corresponding link here, so you can get more information to help you recognize, diagnose, prevent, and repair the problem.

First published on May 7, 2005 at 12:00 am
Worry Watch is compiled by David Radin & Jes Scherder using data and reports from Microsoft, CERT, Panda, and other sources. To contact the compilers of Worry Watch, go to http://www.megabyteminute.com/contactdavid.html