US-CERT is aware of several new variants of the W32/Sober virus that propagate via email. As with many viruses, these variants rely on social engineering to propagate. Specifically, the user must click on a link or open an attached file.

A recent variant sends messages that appear to be from the CIA or FBI, while a German version appears to be coming from the Bundeskriminalamt (BKA), the German Federal police service. US-CERT encourages users to review the appropriate alert below:

• FBI ALERTS PUBLIC TO RECENT E-MAIL SCHEME
• BKA warnt vor gefälschten E-Mails mit BKA-Absender - Variante des Sober-Wurms

These new variants of the W32/Sober virus identified above share common characteristics listed below. Once infected, the malicious code may:

• Attempt to harvest email addresses from a configurable list of file extensions
• Utilize its own SMTP engine to send itself to the harvested email addresses

Although each variant has different functionality, the list below contains a subset of the common characteristics found in previous variants. Once a system is infected, the malicious code may:

• Modify the system registry to prevent Windows XP's built-in firewall from starting
• Attempt to harvest email addresses from a configurable list of file extensions
• Utilize its own SMTP engine to send itself to the harvested email addresses
• Modify the HOSTS file to prevent the computer from accessing certain security and commercial web sites
• Attempt to terminate a number of running processes, some of which are security related
• Open a backdoor on the system that allows the attacker to communicate remotely with the system via IRC. This may allow the attacker to upload and execute arbitrary code on the infected machine.

US-CERT strongly encourages users to install anti-virus software, and keep its virus signature files up-to-date.

Additionally, US-CERT strongly encourages users not to follow unknown links, even if sent by a known and trusted source. You may also wish to visit the US-CERT Computer Virus Resources.