SOBER-C WORM

The Sober-C Worm spreads via infected email attachments. Infected emails will be in English or German.
The worm will display this message after infection:
[Runtime Error] or [Microsoft]
"[virus_name]" has caused an unknown error
Stop: 00000010c08

The worm infects files with the extensions: htt, rtf, doc, xls, ini, mdb, txt, htm, html, wab, pst, fdb, cfg, ldb, eml, abc, ldif, nfo, mht, dbx, nab, adp, mdw, mda, mde, ade, sln, dsw, dsp, vap, php, nsf, asp, shtm

REMOVAL INSTRUCTIONS:

• Run REGEDIT and delete the values:
  • "random_value"="[system_directory]\[worms_name.extension]
    in registry key:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "random_value"="[system_directory]\[worms_name.extension]"
    in registry key:
    [HKEY_USERS\{user_id}\Software\Microsoft\Windows\CurrentVersion\Run]
• Run Vbuster.Exe and use it to delete all occurances of the worm

Return Home