Bilingual bogus Microsoft virus.

Sophos have warned customers to be wary of a bilingual bogus Microsoft virus fix which claims to protect against the MyDoom worm.

The Sober-D worm (W32/Sober-D, also known as W32/Roca-A), has already been sighted several times in the wild, and arrives as an email with the subject line 'Microsoft Alert: Please Read!'. The message text claims that a new variant of the MyDoom worm has been discovered and is spreading rapidly. It claims 'Anti-virus vendor Central Command claims that 1 in 45 e-mails contains the MyDoom virus. The worm also has a backdoor Trojan capability. By default, the Trojan component listens on port 13468' and asks computer users to download an attachment which will apparently update protection against the worm.

The email attachment is a ZIP file which contains the Sober-D worm. If the worm determines it is being sent to a German email address, it presents itself in German language instead of English. Computer users shouldn't be tricked into trusting security fixes which arrive via email--the only place from which to download a patch is from the appropriate vendor's website.

More information about the Sober-D/Roca-A worm can be found at www.sophos.com/virusinfo/analyses/w32rocaa.html