Watch Out for the Sober.Z Worm

(I posted this to The Farm and Tucows Developer — I also thought I’d post the warning on this blog as well — Joey)

“Nazis.

I hate these guys.” — Indiana Jones

---

The

Sober.Z

worm is a worm that runs on the Windows platform. It began

infecting computers worldwide back in November and goes by a number of

names:

• W32.Sober.X@mm
• W32/Sober@MM!M681
• WORM_SOBER.AG
• W32/Sober-X
• W32/Sober-Y
• W32/Sober-Z

The

source code for the Sober.Z worm suggests that it

will launch another

attack on January

5th and 6th to coincide with the 87th anniversary of the

founding of the Nazi Party. On these dates, PCs infected with the virus

will be instructed to connect to numerous servers to download malicious

code that will likely send out German and English language email hate

messages.

Tucows encourages network administrators to

protect themselves by blocking domains believed to host the malicious

code, which

are:

• http://people.freenet.de/
• http://scifi.pages.at/
• http://home.pages.at/
• http://free.pages.at/
• http://home.arcor.de/

Be

sure to tell people you know — especially if they aren’t tech-savvy —

not to open suspicious email, even if it appears

to be from a sender they know.

For more details on

the Sober.Z worm, consult these

sites:

• F-Prot
• F-Secure
• Sophos
• Windows

  Live Safety Center

• Viruslist.com