Sober.R - MEDIUM RISK by McAfee
http://vil.nai.com/vil/content/v_136390.htm
Other AV companies
http://secunia.com/virus_information/22225/sober.s/
EMAIL TO AVOID - English & German variants
QUOTE
Subject: Your new Password
Body:
Your password was successfully changed! Please see the attached file for detailed information.
Body:
Your password was successfully changed! Please see the attached file for detailed information.
QUOTE
Subject : Fwd: Klassentreffen
Body:
ich hoffe jetzt mal das ich endlich die richtige person erwischt habe! ich habe jedenfalls mal unser klassenfoto von damals mit angehngt. wenn du dich dort wiedererkennst, dann schreibe unbedingt zurck!!
wenn ich aber wieder mal die falsche person erwischt habe, dann sorry fr die belstigung ;)
liebe gr
Rita,
Body:
ich hoffe jetzt mal das ich endlich die richtige person erwischt habe! ich habe jedenfalls mal unser klassenfoto von damals mit angehngt. wenn du dich dort wiedererkennst, dann schreibe unbedingt zurck!!
wenn ich aber wieder mal die falsche person erwischt habe, dann sorry fr die belstigung ;)
liebe gr
Rita,
This mass-mailing email virus arrives in an email message with one of the following attachment names: KlassenFoto.zip, pword_change.zip
SPECIAL INSTRUCTIONS FOR INFECTED PCs
Cleaning this new variant is difficult as some new techniques used by the virus writer lock down security of infected files, (blocks access to files using special registry settings), so that you have to clean in SAFE MODE until McAfee releases it's next DAT file (which will reset file access permissions in the registry to allow direct cleaning).
QUOTE
Due to the nature in which this virus operates once a machine is successfully infected, read-access to its file may be denied. The AV scanner will not be able to detect the file in this case. Because of this, if a machine is suspected to be infected, users are recommended to follow the procedure below:
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Run a system scan using the specified engine/DATs.
Delete files flagged as infected
Restart machine in default mode.
Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Run a system scan using the specified engine/DATs.
Delete files flagged as infected
Restart machine in default mode.
