- The AH Variant of This Infamous Worm is Designed to Activate Between the 5th
and 6th of January 2006, the Anniversary of the Foundation of the Nazi Party.
   It is Suspected That Computers Infected by This Worm Could, for Example,
                Become Zombies for Distributing Pro-Nazi Spam

- To Prevent This Attack, Sober.AH Must Be Eliminated From Computers it Might
Be Installed On.  Panda Software Offers Users Free Tools to Remove This Worm.

    GLENDALE, Calif., Dec. 20 /PRNewswire/ -- The recent Sober.AH epidemic
could actually be part of a neo-Nazi strategy to saturate mailboxes worldwide
with pro-Nazi spam.  According to data from PandaLabs, this worm is designed
to connect to numerous servers between the 5th and 6th of
January 2006.  This could enable it, among other actions, to download a
malicious file which could turn computers infected by Sober.AH into zombies,
spreading 'political' spam.
    The theory behind this possible attack is based on events associated with
previous versions of Sober.  In June 2004, Sober.H sent emails to thousands of
users -- mainly German and Dutch -- with content such as "what Germany needs
is German children," or other racist messages.  This attack was related to the
following day's elections for the European Parliament.
    According to Luis Corrons, director of PandaLabs: "We are seeing an
increasing number of attacks related to so-called 'hacktivism,' that is,
cybercrime with a political slant.  Bear in mind that IT has become a key
resource in society and so these kinds of large-scale attacks do not just make
waves in the media but can also, depending on the seriousness, have grave
consequences at all levels."
    There could still be a considerable number of computers infected by
Sober.AH.  This worm, towards the end of November 2005, caused an Orange Virus
Alert due to the number of incidents reported around the world.  Even today,
it is still one of the viruses most frequently detected by Panda ActiveScan,
which underlines the fact that it is still widely distributed.
    To prevent a possible attack from Sober.AH, it must be removed from all
infected computers.  People should be suspicious, especially where there are
computers without sufficient antivirus protection, or where the protection is
not updated.  "Remember that Sober.AH caused the most serious epidemic in
2005, and so many computers could have been affected without users realizing
it.  Such computers will be the ones that carry out a possible attack in
January.  A computer connected to the Internet could become the source of
malicious code others users if adequate measures are not taken," explains
Corrons.
    Panda Software has made free tools available to all users to eliminate
Sober.AH from infected computers, including the PQREMOVE utility.  This tool
can be downloaded from http://www.pandasoftware.com/download/utilities/.  In
addition, to disinfect computers immediately, Panda Software offers users the
Panda ActiveScan online anti-malware solution free at
http://www.pandasoftware.com/home/default.asp.
    TruPrevent(TM) detection technologies detect and eliminate Sober.AH with
no need for previous updates, so computers with these technologies have been
protected from the moment the worm appeared.
    For further information about Sober.AH and Sober.H, visit Panda Software's
Encyclopedia.

    About PandaLabs
    Since 1990, its mission has been to analyze new threats as rapidly as
possible to keep our clients safe.  Several teams, each specialized in a
specific type of malware (viruses, worms, Trojans, spyware, phishing, spam,
etc), work 24/7 to provide global coverage.  To achieve this, they also have
the support of TruPrevent(TM) Technologies, which act as a global
early-warning system made up of strategically distributed sensors to
neutralize new threats and send them to PandaLabs for in-depth analysis.
According to AV-Test.org, PandaLabs is currently the fastest laboratory in the
industry in providing complete updates to users (more info at
http://www.pandasoftware.com/pandalabs.asp).

    For more information: http://www.pandasoftware.com/virus_info

    For more information:
    Carolina Sanabria
    Public Relations Manager
    Panda Software, USA
    Tel: 818-543-6909
    [email protected]