A new Sober worm variant is tricking users into opening an attachment with persuasive messages in English and Germany.
[email protected] comes in an email with subject headers "I've_got your EMail on my_account!" and "FwD: Ich bin's nochmal" and carries attachments with names like your_text.zip. When opened, the attachment scans files on the infected computer to harvest e-mail addresses that enable the worm to spread.
The worm first appeared early this morning and has been spreading across Europe, particularly in German speaking countries, according to Mikko Hypp"nen, director of anti-virus research at F-Secure.
The body text for the English version begins "Hello, First, Very Sorry for my bad English. Someone is sending your private e-mails on my address." It then tells the recipient that ten of their personal e-mails are attached in a zip file.
The German versions are slightly more persuasive since it is the writer's first language and most people are used to receiving viruses only in English.
Anti-virus companies don't know who the virus writer is but they suspect it may be a German-speaker living in Europe. Sharp as tacks.