NEWS FROM THE LAB - Sunday, April 4, 2004

Sober.F spreading in the wild Posted by Mikko @ 16:22 GMT

A new variant of the Sober family was found. Again on Sunday. The author of this worm apparently always distributes his latest variants on Sundays. Sober.E was found a week ago on Sunday afternoon and Sober.D was found three weeks before that on Sunday-Monday night.

This new one (known as Sober.F or also as I-Worm.Vb.C) sends highly variable German and English emails which always have an PIF or ZIP attachment. The virus is 42496 bytes long.

We expect most of the infections caused by this worm to be located in Central Europe.