A comeback for the Sober worm

The prolific Sober worm is making yet another comeback, according to the folks at Symantec Security Response.

Hon Lau, a researcher with the Cupertino, Calif.-based antivirus giant, wrote in the Symantec Security Response blog that the lab has seen a marked increase in the activity of a new Sober variant since Sunday.

“A new variant of Sober named W32.Sober.AA@mm is currently being spammed out to many users around the world,” he wrote. “The spam can be either in English or German and uses classic social engineering techniques to trick users into opening and running the attachments.”

The blog entry lists the various subject lines and body text the worm uses in its email messages.

Lau said it’s been a while since the Sober family generated this level of activity. The last named variant was back in 2005. “Just like fashion, things often go out of style, only to make a comeback later,” he wrote. “Could this be the comeback of Sober?”

As usual, he wrote, the advice is to not open email attachments from unexpected sources, even if they appear to be legitimate.