Note: To protect the privacy of our members, e-mail addresses have been removed from the archived messages. As a result, some links may be broken.

Find Lesson Plans on! GettyGames

[teacherartexchange] new worm warning


From: Maggie White (mwhiteaz_at_TeacherArtExchange)
Date: Tue May 03 2005 - 21:25:23 PDT

Hi, all,

It seems it's been a blessedly long time since I've received notice about a worm or virus and passed it on to you. Of course, this streak of good luck had to end, so here is a new warning from a reputable online newsletter.

A new Worm has been discovered today (May 2, 2005) named W32.Sober and it's spreading rapidly! This mass-mailing worm circulates via email using its own SMTP engine to spread and may be in English or German.


Look for the following subject lines, message bodies and attachment names, which are indicative of this worm:


Subject Line: (One of the following)

    a.. Re:Your Password
    b.. Re:Registration Confirmation
    c.. Re:Your email was blocked
    d.. Re:mailing error
    e.. Re: [blank]
Message Body: (One of the following)

    a.. ok ok ok,,,,, here is it
    b.. Account and Password Information are attached!
    Visit: http:/ /www.[random domain]
    c.. This is an automatically generated E-Mail Delivery Status Notification.
    Mail-Header, Mail-Body and Error Description are attached

    Appends one of the following randomly to the bottom of the message:
    d.. Attachment-Scanner: Status OK
    e.. AntiVirus: No Virus found
    f.. Server-AntiVirus: No Virus (Clean)
    g.. http:/ / www.[random domain]

Attachment: (One of the following)


If you have a system that is already infected by this worm, then follow the manual removal instructions here:


For optimal security it is suggested that you update your anti-virus software. You can get more technical information about this outbreak & removal instructions at:


Contact your nearest Data Doctors location for service:

To unsubscribe go to