The next stage of Sober

We mentioned the Sober virus previously here on Spamblogging and at that time noted the anti-virus community felt that the Sober virus was staged to be infect machines, and then later use those infected machines to send out spam.

Well, this morning I started getting calls from my users with complaints generally along the lines of "I am getting a lot of mail in German".

So now we have our answer - the machines infected with the Sober virus are being used to send German hate messages. They are generally in the vein of political messages, which has been increasingly on the rise in spam these days - no longer just selling sex drugs and pirated software - but now trying to sway voter opinions.
The infected machines download software which is then used to send out spam from that machine.

These new messages being sent are spam, so they should be blocked the same way you would spam. If you don't normally get messages in German, then you might look for common traits in the messages and block based on that.
Or if you have a Bayesian learning type filter, then over the next few days it should learn on its own.

Posted by Eric at May 16, 2005 10:01 AM | TrackBack