What is Sober.E Worm and How Did I Get It?

Sober.E is a variant of Sober.D that spreads by sending itself as an email attachment using its own SMTP engine. The worm also attempts to download and execute a file from a remote Web site.

Also known as: Win32.Sober.E, W32/Sober.E@MM, WORM_Sober.E, I-Worm.Sober.E

When Sober.E is first run, it performs the following actions:

1. Copies itself as %System%\<random filename>.exe.
   
   
2. Creates the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
   \Run\<random filename>
   
   so that the worm starts when Windows starts.
   
   
3. Adds the value:
   
   "<random value>" = "%System%\<random filename>.exe %1"
   
   in the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
   \RunOnce
   
   so that the worm starts when Windows starts.
   
   
4. Drops the following files:
   
   • %System%\msWord.wrd
   • %System%\MsHelp32.dat
   • %System%\WinRun32.dll (A log file that contains a list of email addresses collected on an infected machine.)
   • %System%\bcegfds.lll
   • %System%\zmndpgwf.kxx
     
     
5. Launches Microsoft PaintBrush or displays a dialog box with the text:
   
   Graphic Modul not found
   
   
6. If the system is not connected to the Internet, the threat will attempt to connect using any available dial-up connections and may display the following dialog box:
   
   Microsoft Windows
   STOP: 0x80070725  {FatalSystemError}
   System File [filename].exe
   Connection lost or blocked by Firewall
   
   
7. Contacts one of the following Network Time Protocol (NTP) servers on TCP port 37 to determine the date:
   
   • Rolex.PeachNet.edu
   • ntps1-1.cs.tu-berlin.de
   • ntp2.fau.de
   • ptbtime2.ptb.de
   • time.nrc.ca
   • ntp.metas.ch
   • ntps1-0.cs.tu-berlin.de
   • ntp0.fau.de
   • timelord.uregina.ca
   • ntp-1.ece.cmu.edu
   • ptbtime1.ptb.de
   • time.ien.it
   • ntp3.fau.de
   • time.chu.nrc.ca
   • clock.psu.edu
   • ntp1.fau.de
     
     
8. If the date is later than March 24, 2004, the threat downloads and executes %Windows%\ndhaqqth.exe from one of the following Web sites on TCP port 80:
   
   • home.arcor.de
   • people.freenet.de
     
     
9. Enumerates all the fixed drives on the computer and scans files for email addresses, if they have the following extensions:
   
   • .abd
   • .abx
   • .adb
   • .asp
   • .dbx
   • .doc
   • .eml
   • .ini
   • .log
   • .mdb
   • .php
   • .pl
   • .rtf
   • .shtml
   • .tbb
   • .ttt
   • .txt
   • .wab
   • .xls
     
     
10. Stores the collected email addresses in the file, %System%\WinRun32.dll.
    
    
11. Emails itself to the emails addresses collected above.
    
    The email will have the following characteristics:
    
    From: (One of the following)
    • aRuder
    • g.rulers
    • S.Serger
    • Dude-X777
    • Nicole.Pam
    • R.Summer
    • T.Welder
    • Susan.Ewing
    • E.Ruders
    • Blond.Sybil
    • ......
      
      followed by @gmx.net or @gmx.de.
      
      Subject: (One of the following)
      
    • Hi
    • hi
    • Hi :-)
    • Ok ;-)
    • OK OK
    • OK Ok OK!
    • Hey!
    • Thx !!!
      
      followed by:
      
    • Message-ID: <%Random_String%.qmail>
      
      Body: (One of the following)
    • ;-)
    • ha!
    • HA :-)
    • yo!
    • lol
    • LoL
    • LOL
    • Yo!
      
      Attachment: (One of the following)
    • Text.zip
    • Text.pif
    • Read.zip
    • Read.pif
    • Graphic-doc.zip
    • Graphic-doc.pif
    • document.zip
    • document.pif
    • Word.zip
    • Word.pif
      
      
      The worm skips the email addresses that contain the following substrings:
      
    • arcor
    • bigfoot
    • hotmail
    • online
    • web
    • yahoo

How to Remove Sober.E Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Sober.E during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Sober.E worm.

1. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

2. Updating the Virus Definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

3. Identifying the Malware Program

To remove this malware, first identify the malware program.

1. Scan your system with your Kaspersky antivirus product.
2. NOTE all files detected as Sober.E.

4. Terminating the Malware Program

This procedure terminates the running malware process from memory. You will need the name(s) of the file(s) detected earlier.

1. Open Windows Task Manager.
   On Windows 95/98/ME systems, press
   CTRL+ALT+DELETE
   On Windows NT/2000/XP systems, press
   CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the malware file or files detected earlier.
3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. Do the same for all detected malware files in the list of running processes.
5. To check if the malware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.

5. Removing Autostart Entries from the Registry

Removing autostart entries from registry prevents the malware from executing during startup. This is also an effective way to terminate its process. In this procedure, you will need the name/s of the file/s detected earlier.

1. Open Registry Editor. Click Start>Run, type Regedit then hit Enter.
2. In the left panel, double click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>RunOnce
3. In the right panel, locate and delete the entry or entries whose data value is the malware path and file name of the file/s detected earlier.
4. Again in the left panel, double click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>Run><random key>
5. In the right panel, locate and delete the entry or entries whose data value is the malware path and filename of the file/s detected earlier.
6. Close Registry Editor.

6. Run a full system scan and delete all the files detected as Sober.E.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Sober.E, click Delete.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Detect and Removal Instruction for Other Worms - 'S':