Sober Worm virus : Virus Alert : Sony South Africa

Recently, there is a new type of virus called W32/Sober.k Worm widely spreading.
These are mass-mailing worm that uses its own SMTP engine to send itself to email addresses it gathers from the compromised computer. The subject of the email varies and is in either English or German. The email sender address is spoofed. The name of the email attachment varies, and it has a .bat, .com, .pif, .scr, or .zip file extension. The attachment may also have a double extension. This threat is written in the Microsoft Visual Basic programming language and is compressed with UPX.

System Affected: Windows® 2000, Windows® 95, Windows® 98, Windows® Me, Windows® NT, Windows® Server 2003, Windows® XP

Mail Propagation
The worm extracts target email addresses from the victim machine, and writes them to the file DATAMX.DAM in the %SysDir% . For example:

C:\WINNT\SYSTEM32\DATAMX.DAM

The worm will construct messages using German or English text, depending upon the recipient email address. For recipient addresses containing any of the following, German text is used:

.de
.at
.ch

Recommendation:
Sony recommends all VAIO users having the virus definitions of the Anti-Virus program installed on the VAIO computer to be updated to the latest virus definitions.

How To Check For Infection/Remove The Virus/Protect Against The Virus
Please refer to the following websites.
Symantec (Norton Antivirus)
Network Associates (McAfee Virus Scan)

Information From Anti-Virus Software Vendors
Please visit the Anti-Virus software websites for more detailed information on W32/Sober.k@MM Worm
Symantec (Norton Antivirus)
Network Associates (McAfee Virus Scan)

Additional Resource