Fact Check

Sober.N Virus

Information about the Sober.N computer virus.

Published Oct. 24, 2013

Claim:

Virus:   "I've Got Your E-Mail" (aka Sober.N)


Status:   Real.

Example:   [Collected on the Internet, 2005]




I HAVE RECEIVED ABOUT 10 MESSAGES FROM UNKNOW PEOPLE WITH VIRUSES
ATTACHED.........

THE SUBJECT LINE SAYS "I'VE GOT YOUR EMAIL ON MY ACCOUNT!"

MOST OF THE NAMES ARE GERMAN............

DELETE THEM RIGHT AWAY.....IT CONTAINS A WORM

I have gotten these emails JUST NOW!!! This is Serious! not a Hoax... this is going threw one of my Groups that I am in and MORE then Me have gotten these emails!!!

Protect yourself and your Groups!!! DELETE these emails ON SITE!

Thank you for your attetion. I don't want anyone getting hit with this.



Origins:   The message quoted above is a reference to the SoberN mass-mailing worm, which replicates by gleaning e-mail addresses from infected computers and sending itself to those addresses as an e-mail attachment. The text of the messages sent by Sober.N can appear in either English or German:



Subject: FwD: Ich bin's nochmal

Verdammt,,,,
ich hatte vergessen Dir meinen Text mitzuschicken.
Aber bitte nicht woanders darueber Reden, ich wuerde mich dann zu Tode blamieren!
Ich melde mich.
Bis bald ;)

Attachment: Private-Texte.zip


Subject: I've_got your EMail on my_account!

Hello,
First, Very Sorry for my bad English.
Someone is sending your private e-mails on my address.
It's probably an e-mail provider error!
At time, I've got over 10 mails on my account, but the recipient are you.
I have copied all the mail text in the windows text-editor for you & zipped then.
Make sure, that this mails don't come in my mail-box again.
bye

Attachment: your_text.zip


See the links below for more information on Sober.N, including removal instructions.

Additional information:








W32.Sober.N@mm W32.Sober.N@mm (Symantec)
W32.Sober.B (F-Secure) W32.Sober.N Virus (F-Secure)

Last updated:   19 April 2005


David Mikkelson founded the site now known as snopes.com back in 1994.