a Malware-Info: Worm.Win32.Sober.D

Symptoms:
Presence of registry key:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun or RunOnce

with a value formed with the folowing words:

sys,host,dir,explorer,win,run,log,32,disc,crypt,data,diag,spool,service,smss32

pointing to a file in Windows Directory whose name is formed with the above words too, and the presence of that file.

Technical description:
The worm comes by mail in the following form, in German or English language:

Subject:
Microsoft Alert: Please Read!
or
Microsoft Alarm: Bitte Lesen!”