Threat Advisory: McAfee AVERT raises risk assessment to medium on new W32/Sober.j@MM virus; McAfee AVERT raises risk assessment based on prevalence.

M2 PRESSWIRE-19 November 2004-McAfee Inc: Threat Advisory: McAfee AVERT raises risk assessment to medium on new W32/Sober.j@MM virus; McAfee AVERT raises risk assessment based on prevalence(C)1994-2004 M2 COMMUNICATIONS LTD

RDATE:11192004

McAfee, Inc. (NYSE: MFE) the leading provider of intrusion prevention solutions, today announced that McAfee(R) AVERT(TM) (Anti-virus and Vulnerability Emergency Response Team), the world-class research division of McAfee, Inc., raised the risk assessment to Medium on the recently discovered W32/Sober.j@MM virus, also known as Sober.j. This new variant is a mass-mailing worm that sends itself to harvested email addresses found on an infected machine. If infected, the worm copies itself twice into the system folder, which makes it necessary to remove them simultaneously rather than manually in order to eradicate the worm.

To date, McAfee AVERT has received close to 100 reports of the virus being stopped or infecting users from the field, from both the virus itself as well as customer submissions. Most of these reports have arrived from Europe, with a majority coming from Germany.

Symptoms

Sober.j is an Internet mass mailing worm, with an SMTP engine and compressed with UPX, that once activated, emails itself to addresses found on the victim's machine. Users would need to manually run the attachment in order to be infected and should immediately delete any suspicious email. Users also need to be aware of any alerts from the desktop firewall that a new application is trying to get access to the Internet.

Threat Pathology