{"id":2537,"date":"2005-01-31T21:44:42","date_gmt":"2005-01-31T21:44:42","guid":{"rendered":"http:\/\/www.puerilis.co.uk\/?p=373"},"modified":"2005-01-31T21:44:42","modified_gmt":"2005-01-31T21:44:42","slug":"be-warned-2","status":"publish","type":"post","link":"http:\/\/www.puerilis.co.uk\/?p=2537","title":{"rendered":"Be Warned"},"content":{"rendered":"\n\n
\n\n\n\n\n\n
<\/td>\nVirus Advisory<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n
  <\/td>\n<\/tr>\n
<\/td>\n<\/tr>\n
<\/td>\n\n\n\n\n\n
CURRENT THREAT<\/td>\n <\/td>\n\nW32\/Sober.k@MM<\/strong>
\nMedium Risk<\/strong><\/td>\n<\/tr>\n<\/table>\n

Current VirusScan users with DAT 4424 are protected from this threat.<\/p>\n

<\/p>\n

What Is It?<\/p>\n

\nThe 11th variant of the Sober virus, W32\/Sober.k@MM<\/b><\/font> is a Medium Risk mass-mailing worm hiding inside an email attachment. When run, the worm displays a fake error message in Notepad, infects the host computer and sends itself to stolen email addresses. Outgoing messages may be in German or English, depending on the recipient’s domain.<\/p>\n

What should I look for?<\/p>\n

\n
  • FROM:<\/strong> Varies (forged addresses taken from infected system)\n<\/li>\n
  • SUBJECT:<\/strong> English: I’ve got YOUR email on my account!! German: Ey du DOOF Nase, warum beantw…\n<\/li>\n
  • BODY:<\/strong> English: First, Sorry for my very bad English! German: Warum beantwortest Du meine E-Mails nicht?\n<\/li>\n
  • ATTACHMENT:<\/strong> EMAIL_TEXT.ZIP or TEXT.ZIP\n<\/li>\n<\/div>\n

    How do I know if I’ve been infected?<\/p>\n

    Fake error message displayed. Outgoing messages as noted above. Increased network traffic on TCP port 37. Alerts from a desktop firewall (if installed) that a new application is trying to access the Internet.\n<\/p>\n

    How do I find out more?<\/p>\n

    Visit the McAfee home page<\/a>.\n<\/p>\n<\/td>\n

    		• <\/td>\n<\/tr>\n
    <\/td>\n<\/tr>\n
     <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

    Virus Advisory    CURRENT THREAT   W32\/Sober.k@MM Medium Risk Current VirusScan users with DAT 4424 are protected from this threat. What Is It? The 11th variant of the Sober virus,…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2537","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2537"}],"version-history":[{"count":0,"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2537\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2537"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.puerilis.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}