MessageLabs, the email security company, has intercepted a significant number of copies of a new variant of the Sober worm – W32/Sober.C-MM – during the past twenty four hours. The first copy of the virus appears to have been sent from Germany, and Sober.C appears to be most active in that region.
W32/Sober.C-MM is a mass mailing worm that uses its own SMTP engine to send itself to email addresses harvested from infected machines. The worm also spreads via file sharing on P2P (peer-to-peer) networks.
Similar to its predecessor W32/Sober.B-MM, emails containing the worm have varying subject lines and body texts, either in English or German.
Upon execution, the worm will display a fake error message, beginning with the filename in quotes.