This mail comes to you from the Virus Emergency Response Team at
A new Internet worm has been discovered in the wild. It has been named
W32/Sober.O Worm. This worm is one more variant of the W32/Sober Worm.
W32/Sober.O worm is spreading rapidly via the Internet. You are
advisable not to open any file with ZIP extension, until and unless
it is scanned from Protector Plus.
About the W32/Sober.O Worm:
W32/Sober.O is an email worm. This worm will infect Windows systems. The
worm spreads through email.
If you receive any email with any of the following subjects then it is
W32/Sober.O worm. The subject will be either in English or German.
Re:Your email was blocked
Glueckwunsch: Ihr WM Ticket
Ich bin's, was zum lachen
WM Ticket Verlosung
Ihre E-Mail wurde verweigert
The infected mail you receive will have a spoofed 'From' address, which is
picked up randomly from the infected system. The body of the infected mail
contains English or German language contents.
The worm carries an attachment and the name of the infected attachment will
be your domain name, username or from a pre-defined list maintained by the
W32/Sober.O worm. The extension of the infected attachment will be ZIP.