VIRUS ADVISORY: W32/Sober.r@MM - Medium Risk
=============================================
What is it?

The 18th variant of the first Sober virus, W32/Sober.r@MM
is a mass-mailing worm hiding inside a .ZIP attachment.
When run, the worm displays fake error messages, infects
the host computer and sends itself to stolen email
addresses. Messages may come in German or English.

What should I look for?

FROM: Varies
SUBJECT: English: Your new Password. German: Fwd:
Klassentreffen
BODY: English: Your password was successfully changed!
Please see the attached file for detailed information.
German: ich hoffe jetzt mal das ich endlich die richtige
person erwischt habe! ich habe jedenfalls mal unser
klassenfoto von damals mit angehngt.
ATTACHMENT. KlassenFoto.zip, pword_change.zip

How do I know if I've been infected?

Fake error messages displayed. Outgoing messages as noted
above. Note: Receiving an email alert stating that the
virus came from your email address is not necessarily an
indication you are infected. Mass-mailing viruses often
forge (or "spoof") the from address.

Sourece:Mcafee