Need help? Ask the community or hire an expert.
Go to Avira Answers
Alias:Sober.M, Backdoor Trojan
Size:45.222 bytes (packed) 
VDF Version: 

General DescriptionAffected platforms:
* Windows 95
* Windows 98
* Windows ME
* Windows NT
* Windows 2000
* Windows XP
* Windows Server 2003

DistributionThe virus sends itself using itsown SMTP engine with english and german texts. The attachment is a ZIP archive which contains an EXE file.

ich habe ihre e-mail bekommen !


jemand schickt ihre privaten Mails auf meinem Account.

Ich schaetze mal, das es ein Fehler vom Provider ist.

Insgesamt waren es jetzt schon 6 Mails!

Ich habe alle Mail-Texte im Texteditor kopiert und gezippt.

Wenn es doch kein Fehler vom Provider ist, sorge dafuer das diese Dinger nicht mehr auf meinem Account landen, es Nervt naemlich.


The english version appears like this:

your password + accountnumber !


i've got an admin mail with a Password and Account info!

but the mail recipient are you! it's probably an esmtp error, i think.

i've copied the full mail text in the Windows text-editor & zipped.

ok, cya...


Technical DetailsIf Worm/Sober.L is executed, it copies itself in the following locations:

and creates the following entry in the Windows Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows\CurrentVersion\Run\
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .