Home Malware Programs Worms Sober.s

Sober.s

Posted: March 28, 2006

Sober.s is a rapidly spreading Internet worm that propagates by e-mail through messages with attached archives containing copies of the spyware.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 reg_text.zip
    2 services.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunwincheck=%Windir%ConnectionStatusMicrosoftservices.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunwincheck=%Windir%ConnectionStatusMicrosoftservices.exe
Loading...