Where is the worm resident - is it on the PC you are using to access email or on the email server? If its the PC then it looks like Sober variants can be removed from the PC with standard anti-virus software. It installs a file called services.exe in the windows directory and adds reference keys to it in the windows registry to keep it active, killing it requires both of these elements to be removed, usually best managed by AV software rather than hacking around with the regedit program.

If you are getting spam email with the Sober zip file attached you may be able to get it stopped by your email service provider's spam filter.

(Reply) (Thread)

I think it's in the email server. I emailed the abuse line and they confirmed that it was a virus and no my account wouldn't be deleated (whew...). They said to just deleate the messages and ignore them. I'll also use your idea of the email's spam filter and see how that works.

(Reply) (Parent) (Thread)