Sober worm now 4 percent of all e-mail

Sophos claimed that the mass-mailing worm, which has been reported in 40 countries after first appearing on Monday, now accounts for 79 percent of all viruses the company is seeing.

"It's still very widespread," said Graham Cluley, senior technology consultant for Sophos. "It appears to turn off Symantec's antivirus protection and the Windows XP firewall. It seems to do that to set up future attacks." He went on to say that the worm is likely to be preparing computers to distribute spam.

"That's probably why it has become widespread so quickly," he said. "[Virus writers] used spam technology to send it out. Now it's just perpetuating."

Sober.P -- which security companies have variously tagged as Sober.N, Sober.O or Sober.S -- travels as an attachment in e-mails written in English and German. One of the most widely reported e-mail contains an alluring message stating that the recipient has won free tickets to the 2006 World Cup in Germany, but many other types have also been spotted. Once opened, the virus sends itself to e-mail addresses harvested on the infected machine.