Sober Worm

[andysocial]

Looking at Norton's activity log, for the past week I've been averaging 6 Sober worm hits each day. Contrast this with my usual 2 or 3 virus warnings per month, and you can imagine how much traffic this thing is producing across the entire internet.

What is the point of this stupid thing, anyway? I particularly appreciate the emails purporting to be from the FBI or the CIA warning me about my IP being logged while downloading illegal software/music/porn. Yeah, the CIA is tasked with domestic cybercrime. At least they didn't send messages pretending to be from the NSA for a change. :-)

View this post on my blog

Comments

[the-detective.livejournal.com]

can you copy and paste the email?
i wanna see it.

[andysocial]

Here's one of the many infected mails I've received (three this morning).

From: Department@cia.gov
To: XPost@andysocial.com
Date: Mon, 28 Nov 2005 08:22:09 UTC
Subject: You visit illegal websites
Importance: Normal


Dear Sir/Madam,


we have logged your IP-address on more than 30 illegal Websites.


Important:
Please answer our questions!
The list of questions are attached.



Yours faithfully,
Steven Allison

[ernunnos.livejournal.com]

The point is to create more zombies. I believe the author of these worms is working for organized crime on pump 'n dump stock scams. They need compromised zombie computers to send their penny stock promotions. Once their existing zombies are detected and quarantined, they have to create more. February of 2004 was the first wave of viruses created specifically for this purpose, and it's been going on ever since. They usually release a new virus about every 4-5 weeks, followed within days by a fresh round of stock spam.

[andysocial]

Ya know, I looked and didn't find anything that said Sober.X would create zombies, but it makes perfect sense. I'm still getting a flood of those stupid things; I hope it gets knocked down soon.