Symantec Security Response has developed a removal tool to clean the infections of W32.Sober variants.

Symantec Security Response has developed a removal tool to clean the infections of the following W32.Sober variants:
W32.Sober@mm
W32.Sober.B@mm
W32.Sober.C@mm
W32.Sober.D@mm
W32.Sober@mm.enc
W32.Sober.gen
W32.Sober.E@mm
W32.Sober.F@mm
W32.Sober.G@mm
W32.Sober.I@mm
W32.Sober.L@mm
W32.Sober.N@mm
W32.Sober.O@mm
W32.Sober.Q@mm
W32.Sober.V@mm
W32.Sober.W@mm
W32.Sober.X@mm

Note: W32.Sober.gen is a generic detection that detects variants of W32.Sober. If your computer is detected as infected with W32.Sober.gen, download and run the tool. In most cases, the tool will be able to remove the infection.

What the tool does

The W32.Sober Removal Tool does the following:

1. Terminates the W32.Sober viral processes.
2. Deletes the W32.Sober files.
3. Deletes the dropped files.
4. Deletes the registry values that the worm added.