SpamChoke Antispam Software Subscribe to Virus Alert Mailing List Enter your Email (Ex : john@company.com)

W32/Sober.AA Worm  Information about the W32/Sober.AA Worm: W32/Sober.AA is a Mass Mailing Worm. The Worm will infect Windows systems and spreads through email. The subject of the infected mail will be either in English or German language. The subject of the mail in English will be as follows; Your Updated Password! Error in your eMail The subject of the mail in German will be as follows; Fehlerhafte Mailzustellung Ihr Account wurde eingerichtet! Ihr Passwort wurde geaendert! The body of the infected mail will be either in English or German language. The body of the mail in English will be as follows; You notified us that you have forgotten your password.We have changed your password to a random sequence of letters and digits! For more detailed information, see the attached password file ... Your eMail has occurred an unknown error on our Server.Please read your mail and check the text.The full email is attached! The body of the mail in German will be as follows; Danke das Sie sich fuer uns entschieden haben.Um ihren neuen Account zu aktivieren, folgen sie der kurzen Anleitung im Anhang. Es sind nur 2 Schritte noetig! Diese Nachricht wurde Automatisch generiert. - Ihre EMail konnte nicht empfangen oder gesendet werden. Ihr Passwort wurde erfolgreich geaendert.Ihre neuen Account-Daten und Passwort befinden sich gesichert im Anhang! The infected attachment will be any one of the following; Anleitung[Random Numbers].zip Mail_Data[Random Numbers].zip PDaten[Random Numbers].zip Passw_Data[Random Numbers].zip Upon execution of the infected attachment, the worm displays a message box with the following message. WinZip Header is missing! It then copies the following files in PoolData folder created by itself under Windows folder. WinD.osa csrss.exe runnor.ssy services.exe smss.exe spxttx1.xnt spxttx2.xnt spxttx3.xnt xpsys.ddr It modifies the Windows registry at the following locations to load itself during next startup; HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run The worm may try to disable the Auto update and Windows Security center services by modifying some registries. It also tries to terminate some of the security related processes. The worm tries to download a malicious file from any one of the following location. free.pages.at home.arcor.de home.pages.at people.freenet.de scifi.pages.at To propagate itself, the worm scans the files with the following extensions and collects all the available email addresses from the infected system. abc, abx, abd, adb, adr, asp, ade, adp, bak, cfg, bas, cgi, csv, ctl, cls, cms, dbx, doc, dhtm, dsp, fdb, frm, dsw, eml, hlp, imh, imb, imh, ini, jsp, imm, inbox, ldb, log, ldif, mbx, mde, mdw, mda, mdb, mdx, mmf, mht, msg, nfo, nsf, nab, nch, nws, oft, ods, php, pmr, pp, phtm, pl, ppt, rtf, pst, shtml, stm, tbb, slk, sln, txt, uin, vap, vbs, vcf, wab, wsh, xhtml This Worm first appeared on April 30, 2007.  Other names of W32/Sober.AA Worm: This Worm is also known as W32.Sober.AA@mm. Download the FREE Evaluation copy of Protector Plus antivirus software

 About Protector Plus Antivirus Software Packages:

Proland Software is the developer of Protector Plus range of antivirus software packages. Protector Plus 2007 is available for Windows Vista, Windows 95/98/Me, Windows XP, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Protector Plus range of antivirus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

Click here to order Protector Plus anti virus software