Experts at SophosLabs™, Sophos's global network of virus and spam analysis centres, have warned users that the W32/Sober-M worm is spreading in the wild. The worm is currently the fifth most commonly encountered virus in the last 24 hours, being beaten only by variants of the prevalent Netsky and Zafi worms.

The W32/Sober-M worm bulk mails itself in either German or English language, depending on whether it believes the recipient's email address to be owned by a German or English speaker.

Email sent in English have the following characteristics:

Subject line: I've_got your EMail on my_account!

Message text: Hello, First, Very Sorry for my bad English. Someone is sending your private e-mails on my address. It's probably an e-mail provider error! At time, I've got over 10 mails on my account, but the recipient are you. I have copied all the mail text in the windows text-editor for you & zipped then. Make sure, that this mails don't come in my mail-box again. bye

Attached file: your_text.zip

"This latest variant of the Sober worm may catch out the unwary as they open their email inbox," said Graham Cluley, senior technology consultant at Sophos. "It looks like the virus writer is deliberately using 'broken English' to lull people into a false sense of security that it's not a virus that has sent the message through, but an aggrieved email user. The virus plays on people's desire to be a good net citizen – anyone who receives a message like this may feel duty bound to open the attachment and investigate how their computer has been sending erroneous email, but such good intentions could result in a nasty infection."

Sophos recommends companies protect their email with a consolidated solution to thwart the virus and spam threats as well as secure their desktop and servers with automatically updated anti-virus protection. Sophos anti-virus products have been capable of detecting the W32/Sober-M worm since 2:07 a.m. GMT on 19 April, 2005.

news ends

About Sophos. Sophos is a world leading computer security specialist, developing anti-virus and anti-spam software. Headquartered in the UK, the company produces solutions tailored for businesses of all sizes – from small enterprises to global corporations. Sophos is acclaimed for delivering the highest level of customer satisfaction and protection in the industry. The company's products are sold and supported in more than 150 countries and protect more than 35 million users.

Sophos's regional head office for Australia and New Zealand is in Sydney and hosts one of the company's three Computer Virus Research and Development Laboratories to provide global support services.

http://www.sophos.com.au

FOR FURTHER INFORMATION: Sophos's press contact at Gotley Nix Evans is: Michael Henderson (sophos@gne.com.au) +61 2 9957 5555 (tel) +61 413 054 738 (mob) +61 2 9957 5575 (fax)