Sober.O virus

IOL: Computers / IT: "Johannesburg - A new computer virus that has infected scores of computers worldwide has been detected, the NOD32 company said on Wednesday.

NOD32's chief executive officer Justin Stanford said the virus, Sober.O, was first detected on Tuesday and that it had been spreading rapidly via email.

According to Stanford, the virus was detected through NOD32's Virus Radar System.

'Over 100 000 infected samples have been collected in the last 24 hours, marking this as the worst virus onslaught of the year, said Stanford.

'Sober.O uses its own SMTP (simple mail transfer protocol) engine to spread through email and create outgoing messages from a spoofed sender's address that may use the words 'admin', 'info', 'postmaster', and 'web master,' he added.

He said subject lines for these infected emails included a password, registration confirmation, blocked email, and mailing error.

The virus had rapidly risen to the number 2 spot in the top five, and continues to climb, he said.

Stanford said when the email attachment in the infected message was opened, Sober.O collected email addresses from local files and then used the addresses to send itself out to other computers.

'It will also attempt to delete many files on the system. Once a computer is infected, the virus locks the files in the system's memory so that they cannot be easily detected or removed by antivirus products,' he said.

For this reason it was important to detect the virus in a proactive way even before a signature update had been created, he adds.

He said Sober.O also sought and destroyed files in the registry that could potentially disable many anti-virus files and firewall programs. - Sapa "