inactive virus slips through av nets 10/30/03

Inactive virus slips through AV nets Source: PC Pro Date Written: October 30, 2003 Date Collected: October 30, 2003
Antivirus firm Sophos has released a statement describing a new but harmless variant of the Sober worm, which they are calling Sober-enc. Sophos describes Sober-enc as the "detritus" of the main Sober worm, capable of slipping past antivirus filters. Sober-enc sends itself to target machines encoded in an e-mail attachment multiple times, but once it infects the machine, only decodes itself once. Most virus filters only look for versions with a single encoding of the virus. However, Sober-enc will fail to decode properly, causing no harm to the system. Sophos now has an update available to detect the variant. Sophos security consultant Carole Theriault notes that Sober is continuing to grow, mainly in Germany and the United Kingdom, accounting for 62% of virus reports. The United States has yet to see Sober; Sophos' US office has received no reports of the virus.

http://www.pcpro.co.uk/?http://www.pcpro.co.uk/news/news_story.ph...