Sober.P, first detected on Monday, now accounts for 77 percent of all viruses detected by Sophos' threat-monitoring stations worldwide, the British security company said on Tuesday. At the same time, Kaspersky Lab, a Russian maker of antivirus software designed to combat such threats, described the worm's spread in Western Europe as an "epidemic."
"This is a pretty significant virus. We usually don't see it spread to 77 percent of all inbound viruses," Gregg Mastoras, a senior security analyst at Sophos, said. "Usually, it spreads much slower, and users have time to update their computers."
Variants of Sober have been circulated since 2003 and have continued to hit corporate and home systems. The mass-mailing worm has continued to spread because people still open attachments in infected e-mail, despite warnings.
The latest Sober offshoot, which has been tagged as Sober.N, Sober.O or Sober.S at other security companies, uses e-mail written in both English and German. One of its lures is a message saying the recipient has won free tickets to the 2006 World Cup soccer tournament. Once victims open the infected attachment, the virus harvests their e-mail addresses. The virus copies itself onto the user's computer and then sends a similar e-mail to the harvested addresses.
The World Cup message could account for the rapid spread of the virus in Europe, Sophos said. "Many people will be eager to attend one of the biggest sporting events in the world next year, and may think it's worth the risk of opening the e-mail attachment just in case the prize is for real," Graham Cluley, senior technology consultant for Sophos, said in a statement.
Kaspersky Lab claimed that the worm has "broken records in terms of the number of infected messages sent out and speed of propagation throughout Western European segments of the Internet."
Sober.P may end 2005 as one of the worst viruses. Last year, Netsky-P, which accounted for 22.6 percent of all virus incidents, held that title, according to Sophos.
