Iowa State University

ITInformation Technology

Fake mail from FBI or Microsoft is really the Sober virus

This news item expired March 2, 2005. It may contain out-of-date information.
A large number of copies of a recent email virus (W32/Sober.l) were received on campus over the weekend. You can read more about this virus at NAI's site at

This virus has fake but compelling messages from the FBI or from Microsoft. Just receiving the message will not infect a computer. A significant number of people have opened the attachment and infected their computers. Instead, delete the email.

Current virus definitions (2/21/05 or newer) will catch this virus. Those who have instituted automatic updates of VirusScan or Norton will be protected. You should be able to clean this virus using an on-demand scan, current virus definitions, and either VirusScan or Norton. The McAfee Stinger tool ( should also be able to remove this virus.