Virus:Worm/Sober.AB
Date discovered:29/04/2007
Type:Worm
In the wild:Yes
Reported Infections:High
Distribution Potential:High
Damage Potential:Medium
Static file:Yes
File size:89.274 Bytes
MD5 checksum:b8c0c8f33f47c39794dff68489a706ce
VDF version:6.38.01.89
IVDF version:6.38.01.93 - Friday, May 4, 2007
Engine version:6.30.00.07

 General Method of propagation:
   • Email


Aliases:
   •  Symantec: W32.Sober.AA@MM
   •  Mcafee: W32/Sober.gen@MM
   •  Kaspersky: Email-Worm.Win32.Sober.aa
   •  F-Secure: Email-Worm.Win32.Sober.aa
   •  Sophos: W32/Sober-AD
   •  Bitdefender: Win32.Sober.Gen

It was previously detected as:
   •  Worm/Sober.GEN


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Disable security applications
   • Downloads malicious files
   • Uses its own Email engine
   • Registry modification




   - synchronizes time with several ntp servers (ntp.scx.ru, vega.cbk.poznan.pl)
   - event-/time-driven
   - contains encrypted strings
Description inserted by Dennis Elser on Friday, May 4, 2007
Description updated by Dennis Elser on Monday, May 7, 2007

Back . . . .