Sober worm goes on a bender

Sober.i is triggered if you open an infected attachment, which causes a fake error message about WinZip to show. The worm makes two files in the Windows directory using random names. The program then picks up emails from an infected machine and propagates itself by sending a fresh payload to unsuspecting recipients.

The files enter the system registry autorun key, said Kaspersky, and sends the emails by connecting to an SMTP server directly.

The emails have random subjects and random text, while the infected files have .zip, .bat or .pif extensions. µ