New Windows Worm Offers Free Soccer Tickets   - 1,856 Views, 3 Comments

Summary: A new version of the Sober worm, dubbed "Sober V" is using a new tactic to lure users into opening the email in which it lays in wait: free soccer tickets. Timing its launch with that of a genuine mailing campaign by FIFA, ...

Previous Article « Connecticut Sues Vonage, Jumps on the ”Bad Vonage, No 911” Bandwagon
Read Next Article » Spam Arrest Tries to Rewrite History, Asks Authors to Remove Negative Reviews of SpamArrest

  Follow Anne on Twitter     Friend Anne on Facebook

A new version of the Sober worm, dubbed “Sober V” is using a new tactic to lure users into opening the email in which it lays in wait: free soccer tickets.

Timing its launch with that of a genuine mailing campaign by FIFA, the Federation Internationale de Football Association, which is the international governing body for soccer, Sober V announces itself with promises of free tickets to the upcoming 2006 World Soccer Cup, along with the usual assortment of bounced mail and other message spoofs for which Sober is more commonly known. The FIFA mailing was to soccer fans letting them know that their application for World Cup tickets had been successful. It seems Sober V is an opportunistic worm indeed.

Sober V is also bilingual, sending itself in both German and English. It appears that it actually chooses in which language to present and send itself based on things such as the domain to which it is being sent. Diabolical.

The subject lines in the English versions include:

Re:Your Password
Re:Registration Confirmation
Re:Your email was blocked
Re:mailing error
Re: (with nothing following it)

..while the subject lines in German include the free ticket hooks, and are:

Ihr Passwort
Mail-Fehler!
Ihre E-Mail wurde verweigert
Ich bin’s, was zum lachen ;)
Glueckwunsch: Ihr WM Ticket
WM Ticket Verlosung
WM-Ticket-Auslosung

Sober V’s prediliction for sending itself out advertising soccer tickets has prompted FIFA to send out a follow-up message advising people that email from them, including ticket confirmations, will not include attachments. Sober V email contains an attachment within which the worm resides.

New Windows Worm Offers Free Soccer Tickets

 Follow Anne on Twitter

 Twitter Explained in Plain English

 Friend Anne on Facebook

Previous Article « Connecticut Sues Vonage, Jumps on the ”Bad Vonage, No 911” Bandwagon
Read Next Article » Spam Arrest Tries to Rewrite History, Asks Authors to Remove Negative Reviews of SpamArrest

Read more:

»  Cellery Diet Gives Windows Computers Worms

»  New Skype Worm Threatens All Skype Windows Users

»  Worm Entices Windows Users with Pics of a “Dead” Saddam Hussein

»  The Conficker Worm - What it Is, How to Know if You Have it, and How to Get Rid of It

For additional similar stories check out our archives on Virus & AntiVirus

NOTE: We never, ever, ever will recommend any product or service on this site that we have not regularly used ourselves and do not wholeheartedly believe in. That said, in some cases after being very pleased with a product or service, we may enter into a relationship with the provider of that product or service such that if someone purchases that product or service based on our recommendation, we may get a small payment. Such payments go towards the upkeep of the Internet Patrol.

 

3 Comments »

  1. I guess some things never change the worm will try anything once to get into your computer???????????

    Comment by Brad Johnson — 5/5/2005 @ 10:23 am

  2. Brad, why all the “?”s after your badly written comment ?

    Comment by Otis P Drucker — 5/6/2005 @ 8:01 pm

  3. Will they prosecute the author for the value of all the tickets not provided, if caught? Sort of like drug dealers and only jail for tax evasion.

    Comment by Greg — 5/6/2005 @ 9:00 pm

RSS feed for comments on this post.

Leave a comment

Warning! All comments which contain URLs and are clearly just spam to generate a link back to the URL will be deleted on sight. Don't bother wasting your time!

If you are going to include a URL in your comment,
please keep it under 25 characters in length,
or use TinyURL to shorten it before including it in your comment.

Line and paragraph breaks are automatic, your email address is never displayed.
HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

(required)

(required)


If you have not posted a comment here before, we apologize for having to ask you to enter the letters and numbers you see in the image above to validate your comment, but we are being attacked by thousands of comment form spams every day! You only need to do this once; once you have successfuly posted a comment here you will not be asked to do this again. Thank you for your understanding!

 
 This article first appeared on 5/4/2005
The Internet Patrol
Patrolling the Internet for You!