We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Worm:Win32/Sober.I@mm
Detected by Microsoft Defender Antivirus
Aliases: WORM_SOBER.I (Trend Micro) W32.Sober.I@mm (Symantec) W32/Sober.j@MM (McAfee) Win32.Sober.I (CA)
Summary
Win32/Sober.I@mm is a mass-mailing worm that targets certain versions of Microsoft Windows. The worm sends itself as an attachment to e-mail addresses that it finds on an infected computer. The worm is activated when a user opens the attachment.
To remove Win32/Sober.I@mm, you must use a removal tool such as the Windows Malicious Software Removal Tool, or a tool provided by a member of the Virus Information Alliance.
After you remove Win32/Sober.I@mm from an infected computer, it is important to take steps to prevent re-infection. Do not reconnect your computer to the Internet until the computer is protected from re-infection. See the "Preventing Infection" section for more information.
Follow us
