Sober sends Registration Confirmation

Be aware of a new Sober variant making its way around the Internet. It sends an email with the following details:

Subject: Registration Confirmation
Message: Thanks for your registration.
Your data are saved in the zipped Word.doc file!
Attachment: registration.zip

The zip file contains another file called Word-Text_packedList.exe. If you extract this file, it attempts to disguise itself by using the actual Microsoft Word icon.

If you accidentally execute this worm, you can identify it by looking for concon.www and services.exe in C:/Windows/ConnectionStatus/Microsoft.

More information about this worm can be found at:

McAfee - Sober.T