Bilingual worm masquerades as Microsoft patch

Bilingual worm masquerades as Microsoft patch

Summary: Sober.D, a mass-mailing worm, pretends to be official protection against the rival MyDoom virus

TOPICS: Security

The latest variant of the mass-mailing Sober worm, discovered on Monday, masquerades as an official Microsoft patch for the MyDoom worm.

Sober.D is technically similar to its previous incarnation as Sober.C, where it used its own SMTP engine to send copies of itself to email addresses found on infected systems, but the latest version displays fake Microsoft warnings and error messages.

"It arrives in an email that pretends to be a patch to protect against a version of MyDoom," said senior technology consultant Graham Cluley of antivirus company Sophos. "The email appears to be a Microsoft patch so people will of course double-click on that attachment."

According to Finnish antivirus company F-Secure, Sober.D spreads either as an executable attachment or inside a password-protected Zip archive attached to an email. Once a user clicks on the file, the worm scans the PC to see if it has already been infected. If the system is clean, a small box appears with the message: "This patch has been successfully installed." If the system is already infected with Sober.D, the message says: "This patch does not need to be installed on this system."

Sober.D also changes its language depending on where it is being sent. If the recipient's email address has either a DE, CH, AT, LI, NL or BE extension, the text will be in German and the subject will read: "Microsoft Alarm: Bitte Lesen". Otherwise the subject line is in English and reads: "Microsoft Alert: Please Read!" Previous versions of Sober have also been biligual, said Sophos' Cluley.

This is not the first time that a worm has disguised itself as a Microsoft update. In January, the Xombe or Trojan.Xombe worm posed as a critical patch for Windows XP. This was believed to be a copycat of 2003's most successful worm, Swen, which is thought to be the first known worm to masquerade as a security warning from Microsoft.

Microsoft has always maintained that it does not email patches to users, so they should ignore any such messages.

Topic: Security

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to start the discussion