W32/Sober.AA is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be either in English or German language.

The subject of the mail in English will be as follows;

Your Updated Password!
Error in your eMail

The subject of the mail in German will be as follows;

Fehlerhafte Mailzustellung
Ihr Account wurde eingerichtet!
Ihr Passwort wurde geaendert!

The body of the infected mail will be either in English or German language.

The body of the mail in English will be as follows;

You notified us that you have forgotten your password.We have changed your password to a random sequence of letters and digits! For more detailed information, see the attached password file ...

Your eMail has occurred an unknown error on our Server.Please read your mail and check the text.The full email is attached!

The body of the mail in German will be as follows;

Danke das Sie sich fuer uns entschieden haben.Um ihren neuen Account zu aktivieren, folgen sie der kurzen Anleitung im Anhang. Es sind nur 2 Schritte noetig!

Diese Nachricht wurde Automatisch generiert. - Ihre EMail konnte nicht empfangen oder gesendet werden.

Ihr Passwort wurde erfolgreich geaendert.Ihre neuen Account-Daten und Passwort befinden sich gesichert im Anhang!

The infected attachment will be any one of the following;

Anleitung[Random Numbers].zip
Mail_Data[Random Numbers].zip
PDaten[Random Numbers].zip
Passw_Data[Random Numbers].zip

Upon execution of the infected attachment, the worm displays a message box with the following message.

WinZip Header is missing!

It then copies the following files in PoolData folder created by itself under Windows folder.

WinD.osa
csrss.exe
runnor.ssy
services.exe
smss.exe
spxttx1.xnt
spxttx2.xnt
spxttx3.xnt
xpsys.ddr

It modifies the Windows registry at the following locations to load itself during next startup;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm may try to disable the Auto update and Windows Security center services by modifying some registries.

It also tries to terminate some of the security related processes.

The worm tries to download a malicious file from any one of the following location.

free.pages.at
home.arcor.de
home.pages.at
people.freenet.de
scifi.pages.at

To propagate itself, the worm scans the files with the following extensions and collects all the available email addresses from the infected system.

abc, abx, abd, adb, adr, asp, ade, adp, bak, cfg, bas, cgi, csv, ctl, cls, cms, dbx, doc, dhtm, dsp, fdb, frm, dsw, eml, hlp, imh, imb, imh, ini, jsp, imm, inbox, ldb, log, ldif, mbx, mde, mdw, mda, mdb, mdx, mmf, mht, msg, nfo, nsf, nab, nch, nws, oft, ods, php, pmr, pp, phtm, pl, ppt, rtf, pst, shtml, stm, tbb, slk, sln, txt, uin, vap, vbs, vcf, wab, wsh, xhtml

This worm first appeared on April 30, 2007.

 Other names of W32/Sober.AA Worm: