A new variant of the Sober email worm is spreading on the internet, though at a much slower rate than on Monday when it was the most prevalent worm on the Net.
The worm was first discovered on Monday at about midday, according to McAfee, a maker of antivirus products. McAfee rates the worm a "medium" risk for home users.
McAfee has dubbed this Sober variant Sober.P. "It may very well be the most prevalent variant to date. They keep getting a little bit worse," Schmugar said.
The worm tricks users into opening attachments with messages in both English and German. It uses different messages randomly and picks a language based on the operating system language. One of the German messages promises free tickets to the 2006 World Cup in Germany.
The attached file is a .zip archive. An error message is displayed when a user opens the file. The worm then harvests email addresses from the victim's PC and sends itself to those addresses.
The worm does no damage other than forwarding itself, which can potentially clog email systems and slow down an infected PC, Schmugar said.
The original Sober worm appeared in October 2003. Since then many variants have hit the internet. All the Sober variants spread mostly in Germany and the US, and most tend to peak in the first day, after which the spread rate drops.
Users are advised to update their antivirus software to keep the definition files current.