Tenacious W32/Sober.c-mm Attacks:
"Top Virus: W32/Sober.C-mm …

W32/Sober.C-mm is a variation of Sober.A, which hit in late October, 2003. Like its cousin, Sober.C spreads as an email attachment, and uses its own SMTP engine to propagate. The worm harvests email addresses from various files on the victim's system, and can spoof the 'from' field as well, when sending copies of itself. The attachment name is randomly chosen from over two dozen different English or German names, and can have a .bat, .pif, .cmd, .scr, .exe, or .com extension. The message and subject line varies, and can be in either German or English. TrendMicro's analysis of Sober.C has a comprehensive list of the subject, attachment name, and message possibilities. The virus infects when the recipient opens the attachment, making it fairly preventable. "

When Sober.C executes, it creates two copies of itself in the %system% folder (by default is C:\windows\system for Windows 9x, C:\Winnt\system32 for Windows 2000/NT or C:\windows\system32 for Windows XP.) The file names are randomly generated, and the files themselves may be appended with random garbage data to inhibit antivirus detection. It then adds the these names to the registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

These entries allow the virus to automatically start when they victim's machine is booted.

The virus scans the victim's hard disk for email addresses within database or text based files, and stores them in the %system% folder under the name savesyss.dll. As an indicator of infection, when Sober.C runs for the first time, it displays a fake error message box with the message:

"First" as caused an unknown error. Stop: 00000010x08.

Sober.C guards its position greedily by running two memory processes that watch out for each other. Terminating a virus process is a standard procedure to do before removing the virus. However, if a user terminates only one of the processes, the other process of Sober.C recognizes its mate is gone, and restarts it, making removal difficult.…

http://www.pcmag.com/print_article/0,3048,a=115641,00.asp