GRAND RAPIDS – A new variant of the Sober worm made the network rounds Tuesday, attempting to entice people into clicking on attachments purporting to be threats from the FBI or videos clips of Paris Hilton, the hotel heiress and her reality TV co-star Nicole Richie.
Antivirus companies said the worm gained some traction over the weekend and on Monday. It’s a minor modification of the “Sober” virus that has flared up several times over the past year. But this latest variant, graded as a medium-level threat, appeared to be trailing off as security providers have responded, CNET.Com reported.
Some antivirus companies said the worm was still spreading fast, however. In a blog posting, security company F-Secure said Internet companies have seen “several millions of infected emails” over the course of hours.
One version of the e-mail carrying the worm appears to be a letter from the FBI saying the agency has found evidence that the computer user has been visiting illegal Web sites. It asks the recipient to click on the attachment to answer questions. The FBI released a warning on Tuesday saying it never sends unsolicited e-mails.
Another version of the e-mail used a message purporting to be from the Central Intelligence Agency. A third, a German-language variant, contained a threatening message from a German law enforcement agency.
A separate version purports to offer a download manager for “video clips, pictures and more” of Hilton and Richie. All operate the same way, once the attachment is activated, however, and a worm drops several files into your computer and searches for e-mail addresses stored in address books. It then sends copies of itself to your email list. If it finds Microsoft’s anti-spyware and antivirus software running, it turns the protections off.
Several other variants of a different virus, dubbed “Mytob,” are also making the rounds. The e-mails carrying them purport to be a message from an e-mail service provider or from support staff providing notification about a changed password or suspended account.
Antivirus companies rate the danger of this worm as “low,” but as always, advise against clicking on unknown attachments to e-mails.
