Emsisoft Malware-Info

Name: Worm.Win32.Sober.L

Description:

As it's predecessors, Sober.L spreads as an email attachment in emails which are sent to all email addresses found on the victim's harddisk. Even if the executable file is packed in a .ZIP file, many users open the file and activate the worm this way. For novice users it's hard to see that it is a worm generated email because the email subject is "your password + accountnumber !". The email body text is the following:

hi,

i've got an admin mail with a Password and Account info!
but the mail recipient are you! it's probably an esmtp error, i think.
i've copied the full mail text in the Windows text-editor & zipped.
ok, cya...

The recipient is advised to open the attached file "Acc_text.zip". The worm also spreads in a German version, which is used on all German email addresses. The German subject is "ich habe ihre e-mail bekommen !". The email body text is:

Hallo,
jemand schickt ihre privaten Mails auf meinem Account.
Ich schaetze mal, das es ein Fehler vom Provider ist.

Insgesamt waren es jetzt schon 6 Mails!
Ich habe alle Mail-Texte im Texteditor kopiert und gezippt.

Wenn es doch kein Fehler vom Provider ist, sorge dafuer das diese Dinger nicht mehr auf meinem Account landen, es Nervt naemlich.

Gruss

If you start the worm, you will see this window:
Click to view larger image

More details about Sober.L can be found at the a-squared malware database:
http://www.emsisoft.com/en/malware/?Worm.Win32.Sober.L

Protection:

a-squared Free users are advised to run the online update, to be able to remove the worm if the computer becomes infected.
a-squared Personal users are protected, even if they don't have the latest online updates installed. The new IDS technology of the background guard immediately detects and blocks the worm with the behavior analysis if it manages to run. The a-squared alert window looks like this when the worm is started:
Click to view larger image

 

Removal instructions for Worm Sober L:

To delete this malware infection, please download and install Emsisoft Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

More details about this danger:

Additional information might be found here:

Search at Google for Worm Sober L Search at Google for Worm Sober L
Search at Bing for Worm Sober L Search at Bing for Worm Sober L
Search at Yahoo for Worm Sober L Search at Yahoo for Worm Sober L

How can I protect myself from Worm Sober L?

Important!
You essentially need an antivirus product, that is not only able to clean infections, but also protect your PC permanently from new dangers. This is the only way to prevent data loss and unnecessary hassle and costs of new installations of your operating system.

Take your chance and buy the multiple awarded protection software Emsisoft Anti-Malware today!

Only $40 for the security of your computer.

Buy Emsisoft Anti-Malware online:

Buy Emsisoft Anti-Malware now

Trust only on the best protection software!

Best In Test!

Emsisoft Anti-Malware is the best of 19 tested antivirus programs - Test by MRG - Malware Research Group - June 2009
More independent reviews of anti-malware software