On BNET: Take control of your inbox (finally!)
BNET Business Network:
BNET
TechRepublic
ZDNet

Talkback

Add your opinion
The next Sober virus attack

CNET Senior Editor Robert Vamosi explains how and when the Sober virus is expected to strike again and what you can do to protect yourself against this mass-mailing worm.

I m Robert Vamosi, senior editor, CNET.com. Today I m going to be talking about the next sober virus attack. There have been more than 20 variants of the sober virus and each one of them uses what I call a bootstrapping effect. That is, the virus writer initially sends out the first wave of viruses that infect a small pool of PC s on the Internet. At a predetermined date, those PC s then call out to servers for additional instructions. The additional instructions often are a second wave of attacks so these initially infected computers will then infect even more computers out on the Internet.

It is the second wave of attacks that s we re concerned about because we think it will happen on January 5, 2006. How do we know that? Within the virus code, the virus writer often leaves instructions for the virus, what day and what servers to contact. So we have a date and we have ISP s out on the Internet. In the past, these were coded in plain text so that we could read them. Then they started encrypting them but the anti-virus companies figured out how to crack that code. With the latest sober variant, they figured out a way to randomize these ISP s so a given date might match up to different ISP s.

So how do we know which day the next sober virus will attack? We think it is going to be January 5, 2006 because of some social engineering. Previous versions of the sober virus have coincided with important dates in Nazi history. Also the virus has spread Nazi propaganda on the Internet. January 5th happens to be the 85th anniversary of the founding of the Nazi party in Germany.

So what can you do to keep your desktop PC s from being involved in the next sober virus attack? First, check your PCs and make sure that they re not already infected with the sober virus. If they are, clean them with an anti-virus program now. Second of all, set a firewall rule to block access to the ISP s that are associated with the attack on January 5, 2006. To find out those ISP addresses, read my Security Watch column at security.cnet.com.