*********************************************************************<br />****************** SYMANTEC SECURITY ALERT **************************<br />*************** Alert! W32.Sober.F@mm *************************<br />*********************************************************************<br /><br /><br />WARNING: W32.Sober.F@mm<br />Threat level: Category 3, Moderate (scale of 1-5)<br />Type: Worm<br />Protection Updates: April 4, 2004 or later (via LiveUpdate)<br /><br /><br />*********************************************************************<br /> What is W32.Sober.F@mm and how does it affect me?<br />*********************************************************************<br /><br />W32.Sober.F@mm is a variant of W32.Sober.E@mm that spreads itself as<br />an email attachment.<br /><br />As of April 4, 2004, due to an increase in submission rate, Symantec<br />Security Response has upgraded this threat to a Category 3 from a<br />Category 2.<br /><br /><br />The "Subject" and "Body" of the email vary and are written in German or<br />English.<br /><br />Notes:<br />· Symantec Consumer products that support the Worm Blocking<br /> functionality automatically detect this threat as it attempts to<br /> spread.<br />· The worm does not have a static MD5 hash value.<br />· Symantec Security Response has developed a removal tool to clean the<br /> infections of W32.Sober.F@mm.<br /><br /><br />+---------------------------------------------------------------------+<br />For more technical information, refer to the W32.Sober.F@mm writeup at:<br /><br />
http://securityresponse.symantec.com/avcenter/venc/data/w32.sober.f@mm.html<br />+---------------------------------------------------------------------+<br /><br /><br />**********************************************************************<br /> WHAT ACTION CAN I TAKE FROM HERE?<br />**********************************************************************<br /><br />** Run LiveUpdate **<br /><br /> Symantec Security Response posted virus definitions to protect<br /> against this threat on March 26, 2004 (via LiveUpdate). All users<br /> of Norton AntiVirus who do not have up-to-date virus protection<br /> should immediately run LiveUpdate for protection from W32.Sober.F@mm .<br /><br /> Virus definitions are available via the LiveUpdate feature in the<br /> Norton AntiVirus product or the Symantec Security Response Web site:<br /><br />
http://securityresponse.symantec.com/avcenter/defs.download.html<br /><br /><br /> Symantec Security Response encourages all Norton<br /> AntiVirus users to regularly download virus<br /> definitions in order to protect against future<br /> threats. For more information on how to run<br /> LiveUpdate, please go here:<br /><br />
http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/1999121613163206<br /><br /><br />** Upgrade Customers **<br /><br /> If you have an older version of Norton AntiVirus<br /> and would like to upgrade to Norton AntiVirus 2004,<br /> please go here:<br /><br />
http://nct.symantecstore.com/0001/upgrade_center.html<br /><br /><br />** New Customers **<br /><br /> TO purchase Norton AntiVirus (TM) 2004, please go here:<br /><br />
http://www.symantecstore.com/51410/nav<br /><br />***********************************************************************<br /><br />Sincerely,<br /><br />Symantec Security Response Team<br />Symantec Corporation
