This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Visual Symptoms When the ZIP archive is extracted and the contained PIF file is manually executed, the virus may display a fake error message:
Registry Symptoms The worm copies itself to a newly created directory in the WINDOWS directory and creates registry run keys to load itself at system startup.
File Symptoms The following files are created:
The following files are MIME encoded versions of the worm in a ZIP file:
The following files contain email related data (such as domain names)
The following files are copies of the worm:
Network Symptoms The worm attempts to contact different TIME servers (TCP 37):
This worm spreads via email. It sends itself to email addresses that are harvested from files containing the following extensions:
While avoiding addresses containing the following strings:
-- Update 20th May, 2005-- This threat has been downgraded to Low-Profiled risk due to a decrease in prevalence. -- Update 2nd May 13:00 PST -- Due to increased prevalence, this threat has had its risk assessment raised to MEDIUM for Home Users.
Note: Receiving an email alert stating that the virus came from your email address is not an indication that you are infected as the virus often forges the from address.
This threat is proactively detected with the 4443 DAT files, or newer, as W32/Sober.gen@MM.
This threat arrives in an email message with one of the following attachment names:
Inside the ZIP archive is a file named winzipped-text_data.txt .pif
Like many Sober variants, this variant uses several different email messages randomly, in either English or German depending on the version of Windows. One such German message states that the recipient has won tickets to the worldcup:
Subject : WM-Ticket-Auslosung Body: Herzlichen Glueckwunsch,
beim Run auf die begehrten Tickets für die 64 Spiele der Weltmeisterschaft 2006 in Deutschland sind Sie dabei.
Weitere Details ihrer Daten entnehmen Sie bitte dem Anhang.
Ihr "ok2006" Team St. Rainer Gellhaus
--- FIFA-Pressekontakt: --- Pressesprecher Jens Grittner und Gerd Graus --- FIFA Fussball-Weltmeisterschaft 2006 --- Organisationskomitee Deutschland --- Tel. 069 / 2006 - 2600 --- Jens.Grittner@ok2006.de --- Gerd.Graus@ok2006.de
An example of a randomly generated English message is as follows:
Subject: Your Password Body: Account and Password Information are attached!
Visit: http://www. {sender's domain}
*** AntiVirus: No Virus found *** "{recipient's domain} " Anti-Virus *** http://www. {recipient's domain}
All Users Use the latest engine and DAT files for detection and removal. On-Demand Scans should always include scanning memory, which may be required to detect and remove this threat.
4.3.20 scan engine users: Due to the nature in which this virus operates once a machine is successfully infected, read-access to its file may be denied. The AV scanner will not be able to detect the file in this case. Because of this, if a machine is suspected to be infected, users are recommended to follow the procedure below: Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode. Run a system scan using the specified engine/DATs. Delete files flagged as infected Restart machine in default mode.
Stinger Stinger has been updated to detect and remove this threat. Sober.p is "Stinger.exe" aware, therefore the executeable must be named something other than Stinger.exe. The download link has been changed to s-t-i-n-g-e-r.exe for this reason.
Manual Removal Instructions To remove this virus "by hand", follow these steps:
Intrushield An IntruShield User-Defined Signature (UDS) has been created to detect this threat and is available for download at: https://mysupport.nai.com/ Knowledgebase Article KB38001 Please note: The above knowledgebase article is password protected and requires your to log into Service Portal before accessing it.
Risk Assessment:
Date Discovered:
Type/Sub-Type: