Worm/Sober

Alias: Worm.Soder, W32/Sober, W32.Sober, W32/Sober@MM

Description: Worm/Sober is a worm-type malware application that written in the Microsoft Visual Basic programming language and compressed with UPX. It spreads itself using mass-mailing functionality of its own SMTP engine. Worm/Sober sends itself to all email addresses it finds at the infected computer. Worm/Sober emails messages with attachments that may have one of the following file extensions: .bat, .com, .exe, .pif, or .scr. The subject text of the email message may vary and be in either English or German. Worm/Sober may display the fake error messages if run.

Threat type:

Worm - A Worm is a virus-like software application which spreads itself to other computers. Worms send themselves out to email addresses collected from the infected PC. Worms are known to mutate and they usually carry a destructive payload.

Advice: Remove This is a very high risk threat and should be removed immediately as to prevent harm to your computer or your privacy.

Detection:
SpyNoMore detects Worm/Sober: Yes

Threat risk: Very High Risk

Extremely dangerous malware. Uses stealth installation, randomly named entries and has the capability to self update or resurrect after incomplete removal. Almost impossible to remove manually. Category mostly consists of trojans and spyware.

Symptoms:

Worm/Sober Signature Details: The following information includes some of the standard signatures associated with this spyware threat. Please do not attempt to manually remove these items from your computer; Removing these items incorrectly or partially can cause your computer to experience critical errors, prevent your computer from restarting or cause loss of Internet connectivity. Should you be infected with Worm/Sober, you can clean your computer by downloading SpyNoMore now.

Running Process Signatures:
N/A

File Signatures:
N/A

Registered Dll (Dynamic Link Library) Signatures:
N/A

Folder Signatures:
N/A

Registry Signatures:
N/A

SpyNoMore Collected Residual File Signatures:
N/A

See Also:
Adware/The Best Offers Network
Adware/MyGreatHunt
Trojan/Downloader-LE.gen
Commercial RAT/Remote Anything 5.7.5
Homepage Hijacker/Adlight
Ransomware/SpyAxe
Trojan/ZLOB
Ransomware/SpywareStrike