A new strain of the Sober virus has been broadcast in high volumes over the net with millions of copies attempting to attack email users by pretending to be mesages from US law enforcement agencies.

Anti-virus vendor, MessageLabs, reports interception of over 2.7-million copies of the new Sober virus, many of which are being spoofed to appear as though they are sent from the FBI or the CIA. The first copy was stopped on 21 November US time.  According to MessageLabs, the size of the attack indicates that this is a major offensive and one of the largest in the last few months.

The emails suggest to recipients that their internet use has been monitored by the FBI or CIA and that they have accessed illegal Web sites. The email directs users to open the ZIP attachment containing the executable, which once opened delivers the Sober virus payload.  It then spreads by searching the infected computer for other email addresses to send copies of itself to, but ignoring any domains for certain security organizations, including MessageLabs.

The virus will send emails in German for domains ending .DE or .AT and a few others, with the remainder being sent in English.  Despite warnings, many recipients are reportedly still opening the emails allowing the virus to spread still further.