Sober.Q (aka "Nazi-Worm") started a new phase in its lifecycle last night.
The worm was supposed to start the update phase few hours ago, at 23rd of May at midnight GMT. This means that instead of sending out the spam, it will poll for updates at predefined web locations. We have carefully analyzed the complex algorithm that generates the update URLs and can confirm that the locations do not currently have anything for the virus to download. These URLs are hosted on sites that offer free web space for anybody and the virus writer simply might not have access to the addresses he wants.
