Spamming Sober-Q Trojan horse stopped proactively by Sophos Genotype technology

May 16, 2005 Sophos Press Release


Computers infected by the Sober-N World Cup worm are sending out Nazi spam.

Experts at SophosLabs™, Sophos's global network of virus and spam analysis centres, have successfully protected against the latest update to the Sober worm, using proactive technology.

The Troj/Sober-Q Trojan horse is being used to send out German nationalistic spam from PCs previously infected by the Sober-N worm.

It appears that the Sober-N worm which spread very widely, accounting for nearly 80% of reports in early May, was used to infect as many PCs as possible by posing as tickets for the 2006 World Cup in Germany. The many compromised PCs are now being used to send out masses of spam.

Spam sent by the Trojan horse from infected PCs uses various subject lines including: 'Dresden Bombing Is To Be Regretted Enormously', 'Armenian Genocide Plagues Ankara 90 Years On', 'Dresden 1945' and 'Turkish Tabloid Enrages Germany with Nazi Comparisons'.

The Trojan drops a file onto infected PCs including links to online news stories about previous versions of the Sober worm and the text: 'Ich bin immer noch kein Spammer! Aber sollte vielleicht einer werden :)', which translates to 'I'm not a spammer, but perhaps I should become one :)'.

"Thousands of innocent computer users are unknowingly spewing out this unwanted mail as the Sober author has taken control of their PCs," said Graham Cluley, senior technology consultant at Sophos. "By including links to news stories about previous variants of the Sober worms, it seems that the author is looking for notoriety, but it's unlikely that the thousands deluged with this spam will take kindly to his tactics. This latest piece of malware highlights the links between virus writers and spammers and reinforces the need for everyone to deploy regularly updated anti-virus and anti-spam software as well as a firewall."

Sophos's proactive Genotype™ technology was capable of detecting the Trojan horse proactively (naming it as W32/Sober-Gen), defending customers' computers without requiring an update. Sophos PureMessage, Sophos's consolidated email gateway solution which defends businesses against both spam and viruses, can also block the spam messages sent by the Trojan horse.