The Sober.P worm stopped spreading across the Internet on Tuesday after virus writers remotely silenced thousands of infected computers overnight, experts said on Friday.
The worm, which spread rapidly last week, included code to make it respond to instructions posted on a number of Web sites. Antivirus companies now believe that the virus writers responsible for Sober.P made changes to these Web sites to temporarily stop the worm spreading.
Antivirus company F-Secure saw the worm drop to one percent of virus activity on Tuesday morning from 40 percent of virus activity on Monday — although rival antivirus company Sophos had reported that Sober.P was 84 percent of virus activity on Monday.
"Sober monitors certain URLs," said Mikko Hyppönen, director of antivirus research for F-Secure. "What the worm does depends on the content of the Web site. Someone has changed the content of the Web site and taken remote control of the infected machines."
Hyppönen said the worm did not have an in-built mechanism to stop spreading it on Tuesday. "We weren't expecting this to happen."
Antivirus company Sophos confirmed it had also seen the worm stop spreading, but expects more activity from it.
"The Sober worm is programmed to 'poll' out to the Internet to see if a new component update is available," said Graham Cluley, senior technology consultant for Sophos. "What that update does is entirely up to the virus author — it could mean all of those infected machines could launch a new virus outbreak, begin a DDoS attack, or initiate a spam campaign."
Last week, Sober.P was reported to be circulating the Internet in massive quantities. Sophos said the mass-mailing worm accounted for 5.4 percent of all email and 84 percent of virus activity that the company saw over the weekend.
Sober.P — which security companies have variously tagged as Sober.N, Sober.O or Sober.S — travels as an attachment in emails written in English and German. One of the most widely reported emails contains an alluring message stating that the recipient has won free tickets to the 2006 World Cup in Germany, but many other types have also been spotted. Once opened, the virus sends itself to email addresses harvested from the newly infected machine.
