Top

Summary

Prevalence: High

Name: Sober-Q

Type: Internet Trojan

How it spreads: emails

Affected operating: Windows

Aliases: Email-Worm.Win32.Sober.q ,W32/Sober.q@MM

Date of surface: 14 May 2005

Description

Troj/Sober-Q is a mass mailing spamming internet Trojan for the Windows platform.

Some of the spam emails sent by this Trojan takes to respectable German news outlets, such as Spiegel etc., as reported by MicroWorld, which contain articles on:

"Necessasity of Health Reforms";

"asylum seekers receive first class private supply while medical supply for Germans abolished";

"Dentists- enormous content increases expense of the contribution payers" etc.



Recovery

You have to remove the virus. You need to do one of the following things:

1) The latest virus vaccine update of eScan removes the worm from your system. Ensure that Internet access for your system is running. Right click on and click Download eScan update. The latest updates are downloaded,your system is scanned and the worm is removed.

OR

2) Download the free MicroWorld Anti Virus Toolkit (MWAV Tool Kit). The tool checks your machine for viruses. If any illegal dialers or sniffer tools have been installed they are detected.


MWAV Tool Kit
(Download the free MicroWorld Anti Virus Toolkit that detects viruses in system registry and running processes)

Link 1
Link 2
Link 3

eScan Internet Security Suite (ISS)
(Download MicroWorld`s eScan that detects viruses in system registry,running processes and has a real time monitor)

Link 1
Link 2
Link 3
Link 4
Link 5
Link 6

Advanced

Troj/Sober-Q is a mass mailing spamming internet Trojan for the Windows platform.

Some of the spam emails sent by this Trojan takes to respectable German news outlets, such as Spiegel etc., which contain articles on:

"Necessasity of Health Reforms";

"asylum seekers receive first class private supply while medical supply for Germans abolished";

"Dentists- enormous content increases expense of the contribution payers" etc.

Some of the links contained in these spam mails as reported by MicroWorld are:

http://globalfire.tv/nj/03de/politik/fruehtod_reform.htm

http://www.rp-online.de/public/article/nachrichten/politik/ausland/85804

http://www.spiegel.de/spiegel/vorab/0,1518,323476,00.html

http://www.spiegel.de/wirtschaft/0,1518,353600,00.html

http://www.mjoelnirsseite.de/2100.htm

http://www.spiegel.de/wirtschaft/0,1518,338652,00.html