BEIJING, Nov. 24-- A new variant of the Sober worm, which is flooding e-mail servers around the world, uses tactics to trick users into opening the virus attachment, including posing as messages from the FBI and CIA, security firms warned Tuesday.

Sober.w is the most recent example of the two-year-old Sober family, and shares important characteristics with other variants, including bilingualism(messages arrive in either English or German), address hijacking, and mass-mailing.

These messages, with spoofed return addresses such as"mail@cia.gov" and"admin@fbi.gov," claim that"We have logged your IP-address on more than 30 illegal Websites," and demand that the user open the attached.zip file, which supposedly contains questions to answer.

If the attachment is opened, the computer is infected, and the virus sends copies of itself to any e-mail addresses found on the hard drive.

This variant of Sober generates e-mails that purport to be from the CIA or FBI.

E-mail security vendor MessageLabs of New York City said it blocked more than 2.7 million e-mail messages with the new Sober variant since around 7 p.m. GMT on Monday in what it called a"major offensive."

Other E-mail security vendors have also raised the alert for the new Sober worm variant.

McAfee this morning raised the threat level of Sober to"medium," based on the amount of e-mail traffic it has generated.

F-Secure has rated it a Radar Level 1 Alert, which is the highest alert on its three-step rating system. The Finland-based company said on its Web site that"several millions of infected e-mails have been seen by Internet operators over the last hours."

Symantec rates it a"level 3" threat, with level 5 being the most severe. In a statement Wednesday, the company said it has detected more than 1,600 potential threats from among its corporate customers, and over 300 from consumers, since Nov. 19.

The FBI issued a statement Tuesday warning the public to avoid falling for the scam.

Anti-virus vendors advised customers to update their anti-virus signatures and to be wary of scam e-mail messages. Enditem

(Agencies)