============================================================

VIRUS ADVISORY: W32/Sober@MM!M681 – Medium Risk

————————————————————

DAT Required: DAT 4629

————————————————————

Learn more about W32/Sober@MM!M681 here:

http://us.mcafee.com/root/campaign.asp?cid=16001

————————————————————

FreeScan checks for W32/Sober@MM!M681

Scan now:

http://us.mcafee.com/root/campaign.asp?cid=14462

============================================================

What is it?

A variant of W32/Sober.gen@MM, W32/Sober@MM!M681 is another

mass-mailing worm hiding inside a spam email attachment.

When run, the virus displays a fake error message, infects

the host computer then sends itself to stolen email

addresses. Note: VirusScan users with the latest DAT file

are protected from this threat.

What should I look for?

FROM: Varies

SUBJECT: Examples: Registration Confirmation; Paris Hilton &

Nicole Richie; hi, ive a new mail address

BODY: Example: hey its me, my old address dont work at time.

i dont know why?! in the last days ive got some mails.

i’ think thaz your mails but im not sure!

How do I know if I’ve been infected?

Fake error message (“Error in packed Header”) displayed.

Outgoing messages as noted above. Note: Receiving an email

alert stating that the virus came from your email address is

not necessarily an indication you are infected. Mass-mailing

viruses often forge (or “spoof”) the from address.

What can I do?

Besides keeping your anti-virus protection current,

fortify your PC security by installing McAfee Personal

Firewall Plus — recommended against threats like

W32/Sober@MM!M681 that need Internet access to spread.

http://us.mcafee.com/root/campaign.asp?cid=11276