Sober Worm Resurfaces in Wild

A new variant of the mass mailing Sober worm has surfaced in the wild, according to a threat advisory issued by McAfee Wednesday night. Like its predecessors, Sober.r arrives as a .zip file attached to e-mails written in English and German. McAfee rated the worm as a "Medium" risk for the time being.

According to the advisory, Sober.r "harvests addresses from local files and then uses the harvested addresses to send itself. This produces a message with a spoofed From address." In order to be infected, a user would need to manually extract the executable file from the .zip and run it.