New Virus At Large

[taxexile]

Ticket trap snares Windows users 

In 2006 Germany is hosting the World Cup

Windows users are being warned not to open a virus that poses as a message from football body Fifa.

Some of the messages sent by virus say users have won tickets to the football tournament in 2006.

The variant seems to have caught a lot of people out because its release coincided with a mail out by Fifa telling fans about tickets.

Other messages sent by the bug contain fake warnings about passwords and messages not being delivered.

The new variant of the Sober Windows worm appeared at 8pm on 2 May.

Like other versions of the Sober virus this one is bilingual and sends messages in both English and German.

ENGLISH SUBJECT LINES

Re:Your Password

Re:Registration Confirmation

Re:Your email was blocked

Re:mailing error

Re: [blank]Messages in English warn about problems with passwords, e-mail going astray and registration confirmations.

In a bid to boost its spread, German language messages sent by the virus posed as messages from Fifa telling fans they had won tickets to the 2006 football tournament.

The tactic seems to have succeeded as many security companies said they were catching infected messages in large numbers.

Mikko Hyppoenen, head of anti-virus research at Finnish firm F-Secure, said it had seen reports from more than 30 countries hit by the virus.  GERMAN SUBJECT LINES

Ihr Passwort

Mail-Fehler!

Ihre E-Mail wurde verweigert

Ich bin's, was zum lachen

Glueckwunsch: Ihr WM Ticket

WM Ticket Verlosung

WM-Ticket-Auslosung

Part of this success may be because on 2 May the World Cup organising committee sent out messages telling some fans that their application for team tickets had been successful.

In a message warning fans about the World Cup worm, Fifa said its ticket confirmations travelled without attachments.

By contrast the attachments on infected messages hold the virus code. Anyone opening these attachments will have their computer infected, their address book plundered and a back door into their machine opened for others to use.

The virus is likely to hit home users hardest because the variant was released into the wild late on Monday night and most company security systems would have updated overnight to protect users when they logged in on Tuesday.

Security firms urged users to update their anti-virus software, be vigilant and not to open unexpected e-mails bearing attachments. This variant of the Sober worm affects computers running Windows 2000, 95, 98, Me, NT, Server 2003 and XP.

The first Sober worm was seen in October 2003.

from the bbc news website.

[exchange1973]

some further informations from trendMicro:

http://www.trendmicro.com/vinfo/virusencyc...me=WORM_SOBER.S

regards

exchange1973