The Sober worm was also claiming to be an important message from FBI, CIA and German police officials, security firms warned.
MessageLabs said Tuesday that it had intercepted more than 2.7 million copies of the new virus, the first of which appeared on Monday.
"The size of the attack indicates that this is a major offensive, certainly one of the largest in the last few months," the firm said on its website.
Usually claiming to be from the FBI or CIA, the email directs users to open a ZIP attachment which in reality contains the virus. It then spreads by using the compromised PC's address books to send copies of itself to.
The US Computer Emergency Readiness Team (US-CERT) warned of the new variants of W32/Sober on Tuesday.
"A recent variant sends messages that appear to be from the CIA or FBI, while a German version appears to be coming from the Bundeskriminalamt, the German federal police service," it warned.
The FBI also posted a warning on its website this week, telling users that the agency does not contact persons of interest by that type of email.
.png&h=140&w=231&c=1&s=0)
_(22).jpg&h=140&w=231&c=1&s=0)
_(26).jpg&w=100&c=1&s=0)
iTnews Executive Retreat - Security Leaders Edition
_(1).jpg&h=140&w=231&c=1&s=0)
