► Another variant of the Sober virus, W32/Sober.p@MM is a Medium Risk mass-mailing worm hiding inside an email attachment. When run, the worm displays a fake error message, infects the host computer and sends itself to the email addresses that are harvested from the infected machine. Like many Sober variants, this variant uses several different email messages randomly, in either English or German depending on the version of Windows.

What should I look for?
FROM: Varies (forged addresses taken from infected system)
SUBJECT: Examples: English: Your Password
German: WM-Ticket-Auslosung
BODY: Examples:
English: Account and Password Information are attached!
German: Herzlichen Glueckwunsch,
beim Run auf die begehrten Tickets für die 64 Spiele der
Weltmeisterschaft 2006 in Deutschland sind Sie dabei.
ATTACHMENT: account_info.zip, autoemail-text.zip, LOL.zip,
Fifa_Info-Text.zip, mail_info.zip, okTicket-info.zip, our_secret.zip, _PassWort-Info.zip

How do I know if I've been infected?
When the ZIP archive is extracted and the contained PIF file is manually executed, the virus may display a fake error message which reads "Error: CRC not complete"..