inactive virus slips through av nets 10/30/03

Discussion in 'malware problems & news' started by bigc73542, Oct 30, 2003.

Thread Status:
Not open for further replies.
  1. bigc73542

    bigc73542 Retired Moderator

    Joined:
    Sep 21, 2003
    Posts:
    23,873
    Location:
    SW. Oklahoma
    Inactive virus slips through AV nets Source: PC Pro Date Written: October 30, 2003 Date Collected: October 30, 2003
    Antivirus firm Sophos has released a statement describing a new but harmless variant of the Sober worm, which they are calling Sober-enc. Sophos describes Sober-enc as the "detritus" of the main Sober worm, capable of slipping past antivirus filters. Sober-enc sends itself to target machines encoded in an e-mail attachment multiple times, but once it infects the machine, only decodes itself once. Most virus filters only look for versions with a single encoding of the virus. However, Sober-enc will fail to decode properly, causing no harm to the system. Sophos now has an update available to detect the variant. Sophos security consultant Carole Theriault notes that Sober is continuing to grow, mainly in Germany and the United Kingdom, accounting for 62% of virus reports. The United States has yet to see Sober; Sophos' US office has received no reports of the virus.

    http://www.pcpro.co.uk/?http://www.pcpro.co.uk/news/news_story.ph...
     
Loading...
Thread Status:
Not open for further replies.