Like the previous variants, this one sends itself inside a ZIP
archive as an attachment in e-mail messages with English or
German texts. We also received several different droppers for
this worm variant. They were apparently created by the worm
author manually. They are all detected as 'Sober.u'.
Detection
Sober.U worm is detected with the following F-Secure Anti-Virus
updates: