New Sober variants in the mail

F-Secure announced that it had found three variants of the worm on Tuesday morning, adding a fourth and fifth later in the day.

The Finnish company said one of the variants, Sober.T, was similar to earlier versions of the worm, sending itself as an email attachment with either German or English text.

"This time the author of the Sober worm changed the encryption algorithm for text strings in the worm's body," the company said on its website. "And he included a message for anti-virus vendors in the worm's body, basically saying, 'Use your debuggers, it's fun.'"

German police authorities warned Monday that a new Sober outbreak was on its way, citing a year-long investigation into the worm, according to F-Secure.

Kaspersky Lab and Symantec also both issued Tuesday warnings for new variants. Symantec named the variant W32.Sober.S@mm, while Moscow-based Kaspersky called the new worms Sober.u, Sober.v, Sober.w and Sober.z.

www.f-secure.com
www.kaspersky.com
www.symantec.com