Old school friends are not who you think

Two new spyware email worms which pose as an old school photograph are on the loose.

The Sober-O worm tempts users to open a picture of an old class photo. When people open this file, instead of seeing themselves in a picture, the worm attempts to infect their computer.

If successful, the worm can steal information from the user, forge their email address and use its own spam engine to send itself to any addresses found on the infected zombie computer. Like earlier versions of the Sober worm, the bilingual virus can travel in both English and German language emails.

Experts at SophosLabs say the Sober-O worm is now the second most commonly reported virus to Sophos, accounting for approximately 10 per cent of all reports in the last twelve hours.

Sophos is also alerting users to about a similar variant, Sober-P.

Cluley, senior technology consultant at Sophos, said: "It may be flattering to think that someone has taken the trouble to look you up and make contact, but it's a lot less pleasant when you realise it's really a virus writer trying to hijack your computer.

"The success of websites like FriendsReunited and Classmates.com show that many people have used the net to keep in touch with old school friends. Sophos has seen substantial reports of Sober-O, and the worry is that those targeted will be unable to tell which messages are genuinely from friends, and which ones are designed to cause trouble."

http://www.sophos.com/virusinfo/analyses/w32sobero.html