w32/SOBER virus

25 November 2005

The SOBER virus is back again and it is nasty this time. We have started temporarily blocking all .zip files as a result. This will be a temporary measure and continue perhaps until Thursday.

The SOBER virus rides on an email and is an attached .zip file. When you open the file, all sorts of nasty stuff happens. The latest iteration of the virus is disguising itself as an official looking email from the FBI, CIA or overseas security agency. But over the weekend it morphed into more random email types.

This virus does not affect Macs, only Microsoft-based systems. If you are running any version of Microsoft operating system or Outlook email client, you need to do a virus scan right now.

The reason I am placing the .zip block is my assumption that the SOBER virus will absolutely explode on Monday morning when everyone turns on their computers at work again. I presume that most of the damage will be done by Wednesday or so and the attack will be over. If it lasts longer, I will keep the block on longer.

This filter will also affect anyone who is trying to send a normal ZIP file via email. For the next week or so, you need to use another compression method or use HTTP download to get that file to your clients.

Return to the News and Announcements Menu