Name: Sober.R worm
Also known as: CME-151, W32/Sober.Y.worm (Panda), W32/Sober.r@MM (McAfee), W32.Sober.Q@mm (Symantec), W32/Sober.R@mm (F-Prot, Command), W32/Sober-O (Sophos), Win32.Sober.S@mm (BitDefender),
I-Worm.Sober.U (VirusBuster)
Type: Worm
Discovered: October 05, 2005
Email characteristics: Sober.R arrives in an email message that may be in either German or English language, depending on the recipient's domain. The Sober.R email carries an attachment with one of the following names:
KlassenFoto.zip
pword_change.zip
screen_photo.zip
privat-photo.zip
The zip file contains an executable named either 'PW_Klass.Pic.packed-bitmap.exe' or 'Screen_Photo.jpeg-graphic1.exe'.
System Impact:: If the infected executable is run, Sober.R will create the following files:
%windir%\ConnectionStatus\netslot.nst
%windir%\ConnectionStatus\services.exe
%windir%\ConnectionStatus\socket.dli
%windir%\system32\bbvmwxxf.hml
%windir%\system32\gdfjgthv.cvq
%windir%\system32\langeinf.lin
%windir%\system32\nonrunso.ber
%windir%\system32\rubezahl.rub
%windir%\system32\seppelmx.smx
Note: %windir% signifies the location of the Windows directory, the exact name of which may vary depending on the operating system.
Sober.R modifies the HKCU and HKLM Registry Run keys in order to load when Windows is started:
'WinINet" =C:\WINDOWS\ConnectionStatus\services.exe'
Removal Notes: Use up-to-date antivirus software to identify the worm's files. Either allow the antivirus software to delete these files, or they can be manually deleted. If opting for manual deletion, be sure to also remove the registry modifications made by the worm.
