Security experts said Tuesday that the worm, dubbed Sober.M, reports e-mail addresses of victims back to its anonymous author--a technique known as harvesting. Spammers typically buy these fresh addresses to add to their lists of e-mail recipients.
The e-mail containing the worm is written in bad English with the subject line: "I've got your e-mail on my account."
"It looks like the virus writer is deliberately using broken English to (convince) people the e-mail is not a virus," Graham Cluley, senior technology consultant at antivirus company Sophos, said in a statement.
Sophos said that the newvariant was the fifth most reported virus over the last 24 hours, closely followed by versions of and . It's thought that all the major antivirus companies are now offering protection against the worm, so users should update their virus protection.
Sober.M is a mass e-mailing virus that spreads as a .zip file attachment and affects systems running Microsoft Windows. The e-mail containing the worm sends itself in German or English language. The English version of the e-mail is below.
Subject line: I've_got your E-mail on my_account!
First, Very Sorry for my bad English.
Someone is sending your private e-mails on my address.
It's probably an e-mail provider error!
At time, I've got over 10 mails on my account, but the recipient are you. I have copied all the mail text in the windows text-editor for you & zipped then. Make sure, that this mails don't come in my mail-box again. bye
Attached file: your_text.zip
Dan Ilett of ZDNet UK reported from London.