Sophos says the mass-mailing worm accounted for 5.4 percent of all e-mail the company saw over the weekend and 84 percent of virus activity. That represents an increase compared with Friday, when Sophos said the worm accounted for 4.65 percent of all e-mail and 77 percent of virus activity.
Alert
Sober.P prevention
and cure
Learn more about the
bilingual worm from
CNET.com.
"The strange thing is that we're actually seeing more reports than ever," said Graham Cluley, senior technology consultant at Sophos. "It's increased, and it's even worse than last week. We don't know how many people are infected, but those infected are just spewing these e-mails out."
Cluley said the second most prevalent e-mail threat, the Netsky.P virus, accounted for 0.3 percent of all such threats, and the Zafi.D worm, the third most common, accounted for just 0.08 percent. "Those have been big viruses but have been dwarfed by the Sober worm," he said.
Last week, Sophos said the worm turned off Symantec's antivirus protection and Microsoft's Windows XP firewall on infected machines.
Sober.P--which security companies have variously tagged as Sober.N, Sober.O and Sober.S--travels as an attachment in e-mails written in English and German. One of the most widely reported e-mails contains an alluring message stating that the recipient has won free tickets to the 2006 World Cup in Germany, but many other types have also been spotted. Once opened, the virus sends itself to e-mail addresses harvested from the newly infected machine.
Dan Ilett of ZDNet UK reported from London.
