Sober.N!Zip Worm

This virus comes as an attachment in the form of a .zip file that contains an executable file named ´winzipped-text_data.txt.pif´. The filename contains a dual extension: the first is .txt, followed by many spaces then .pif. When the Zip archive is extracted and the .pif file is manually executed, the virus may display a fake error message.

From the number of similar malformed e-mail message, it looks like it has affected alot of computers around the world.

An example of a randomly generated English message is as follows:

From: (address is spoofed)
Subject: Your Password
Body: Account and Password Information are attached!
Visit: website: www / .[sender´s domain]
*** AntiVirus: No Virus found
*** "[recipient´s domain] " Anti-Virus***
website: www / .[recipient´s domain]

Sober.N!Zip Worm is consider a mass mailing threat that contains its own SMTP engine to construct outgoing messages, which are written in German or English. It harvests addresses from local files and then uses the harvested addresses to send itself. This produces a message with a spoofed From address.