Another Virus disguised as a Microsoft update

XMEN Iceman · Post by **XMEN Iceman** » Tue Mar 09, 2004 4:30 pm

From Anandtech.com: Here's another one to look out for. CNET is reporting that a new variant of the Sober worm is disguising itself as a patch from Microsoft: The latest variant of the mass-mailing Sober worm masquerades as an official Microsoft patch for the MyDoom worm. Sober.D, discovered on Monday, is technically similar to its previous incarnation as Sober.C, where it used its own SMTP engine to send copies of itself to e-mail addresses found on infected systems. But the latest version displays fake Microsoft warnings and error messages. "It arrives in an e-mail that pretends to be a patch to protect against a version of MyDoom," said Graham Cluley, a senior technology consultant at antivirus company Sophos. "The e-mail appears to be a Microsoft patch, so people will of course double-click on that attachment."