/ 23 May 2005

Sober.P has been defeated … or has it?

German internet security experts declared victory on Monday in a bid to head off a computer virus before it spreads through millions of personal computers worldwide.

Sober.P, a computer worm that sent neo-Nazi German-language e-mails on to hundreds of thousands of computers last week, had been programmed by its unknown author to cease activity on Monday and seek reinforcement with new code hidden around the internet.

Virus hunters funded by the German government decided to block the reinforcements by closing down web computers supplying the code.

”Nothing has happened so far today,” said Michael Dickopf, a spokesperson for the Federal Office for Security in Information Technology (BSI). ”Our defensive actions appear to have worked.”

The BSI analysed the worm last week and won help from internet service providers to take down all offending websites. Without access to the code it needs, Sober is expected to remain dormant on infected personal computers.

However, an internet news service, Heise Online, reported Sober.P (also known as Sober.Q at virus sites that count the Sober dynasty differently) is to power up on Thursday and try yet another list of websites.

Sober attacks computers running the Windows 95, 98, ME, NT, 2000, XP and Windows Server 2003 operating systems and causes them to mass-mail offensive messages with fake return addresses. Experts say the best protection is to update anti-virus software. — Sapa-DPA