Sober Removal Tool

Sober Removal Tool is a useful utility that was designed in order to provide you with a means of erasing the Sober malware from any system.

The virus comes in form of an e-mail, with variable subject, body or attachement name. It's written in Visual Basic 6 and packed with UPX.

The virus uses two or three instances of itself at the same time, each checking to see if the other(s) is still running. Killing one of the instances makes the other(s) restart it, making manual killing of the processes difficult. Also, the instances periodically check to see if the registry key is present, and if it's not they recreate it.

The virus looks for email addresses in files with one of the following extensions: htt, rtf, doc, xls, ini, mdb, txt, htm, html, wab, pst, fdb, cfg, ldb, eml, abc, ldif, nab, adp, mdw, mda, mde, ade, sln, dsw, dsp, vap, php, nsf, asp, shtml, shtm, dbx, hlp, mht, nfo. It sends messages in the format described above, using its own SMTP client functions.