Welcome to the Virus Encyclopedia of Panda Security.
It ends several processes belonging to some security tools, among others and displays a fake error when it is run. It spreads via email in a message written in English or German.
|First detected on:||Nov. 21, 2005|
|Detection updated on:||March 10, 2006|
|Yes, using TruPrevent Technologies
|Repair utility:||Panda QuickRemover|
Sober.AH is a worm that ends several processes belonging to some security tools, among others.
Sober.AH spreads via email, in a message written in English or German that contains an attached file with ZIP format.
The email message will be written in German only if the mail domain extension is one of the following: de (Germany), ch (Switzerland), at (Austria) or li (Liechtenstein).
Sober.AH is designed to connect to numerous servers between the 5th and 6th of January 2006, in order to download a malicious file to the affected computer.
Sober.AH is easy to recognize once it has affected the computer, as it displays a fake error with the following text when it is run: