[an error occurred while processing this directive]
BBC News
watch One-Minute World News
Last Updated: Wednesday, 4 May, 2005, 10:13 GMT 11:13 UK
Ticket trap snares Windows users
World Cup trophy and logo, AP
In 2006 Germany is hosting the World Cup
Windows users are being warned not to open a virus that poses as a message from football body Fifa.

Some of the messages sent by virus say users have won tickets to the football tournament in 2006.

The variant seems to have caught a lot of people out because its release coincided with a mail out by Fifa telling fans about tickets.

Other messages sent by the bug contain fake warnings about passwords and messages not being delivered.

Net loss

The new variant of the Sober Windows worm appeared at 8pm on 2 May.

Like other versions of the Sober virus this one is bilingual and sends messages in both English and German.

ENGLISH SUBJECT LINES
Re:Your Password
Re:Registration Confirmation
Re:Your email was blocked
Re:mailing error
Re: [blank]
Messages in English warn about problems with passwords, e-mail going astray and registration confirmations.

In a bid to boost its spread, German language messages sent by the virus posed as messages from Fifa telling fans they had won tickets to the 2006 football tournament.

The tactic seems to have succeeded as many security companies said they were catching infected messages in large numbers.

Mikko Hyppoenen, head of anti-virus research at Finnish firm F-Secure, said it had seen reports from more than 30 countries hit by the virus.
GERMAN SUBJECT LINES
Ihr Passwort
Mail-Fehler!
Ihre E-Mail wurde verweigert
Ich bin's, was zum lachen ;)
Glueckwunsch: Ihr WM Ticket
WM Ticket Verlosung
WM-Ticket-Auslosung

Part of this success may be because on 2 May the World Cup organising committee sent out messages telling some fans that their application for team tickets had been successful.

In a message warning fans about the World Cup worm, Fifa said its ticket confirmations travelled without attachments.

By contrast the attachments on infected messages hold the virus code. Anyone opening these attachments will have their computer infected, their address book plundered and a back door into their machine opened for others to use.

The virus is likely to hit home users hardest because the variant was released into the wild late on Monday night and most company security systems would have updated overnight to protect users when they logged in on Tuesday.

Security firms urged users to update their anti-virus software, be vigilant and not to open unexpected e-mails bearing attachments. This variant of the Sober worm affects computers running Windows 2000, 95, 98, Me, NT, Server 2003 and XP.

The first Sober worm was seen in October 2003.


SEE ALSO:
Helpful users face virus danger
20 Apr 05 |  Technology
Mobile safety at your fingertips
15 Apr 05 |  Technology
Bogus blogs snare fresh victims
14 Apr 05 |  Technology
Hi-tech crime costs UK plc 2.4bn
05 Apr 05 |  Business
IT support for your parents
10 Jan 05 |  Magazine


RELATED BBC LINKS:

RELATED INTERNET LINKS:
The BBC is not responsible for the content of external internet sites


PRODUCTS AND SERVICES

News Front Page | Africa | Americas | Asia-Pacific | Europe | Middle East | South Asia
UK | Business | Entertainment | Science/Nature | Technology | Health
Have Your Say | In Pictures | Week at a Glance | Country Profiles | In Depth | Programmes
Americas Africa Europe Middle East South Asia Asia Pacific