From snopes:
Home --> Computers --> Virus Hoaxes & Realities --> Sober.X (aka 'Illegal Websites')
Sober.X (aka 'Illegal Websites')
Virus: Sober.X (aka "Illegal Websites")
Status: Real.
Examples: [Collected on the Internet, 2005]
Dear Sir/Madam,
we have logged your IP-address on more than 30 illegal Websites.
Important:
Please answer our questions!
The list of questions are attached.
Yours faithfully,
Steven Allison
++++ Central Intelligence Agency -CIA-
++++ Office of Public Affairs
++++ Washington, D.C. 20505
++++ phone: (703) 482-0623
++++ 7:00 a.m. to 5:00 p.m., US Eastern time
--------------------------------------------------------------------------------
Dear Sir/Madam,
we have logged your IP-address on more than 30 illegal Websites.
Important:
Please answer our questions!
The list of questions are attached.
Yours faithfully,
Steven Allison
*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
Origins: Like the earlier Sober.C mass-mailing worm which hit in 2003, this latest version (Sober.X) employs phony warning messages supposedly sent by law enforcement agencies which claim to be tracking illegal Internet activity. In this case, the messages purport to come from a "Steve Allison," an investigator with either the FBI or the CIA, and state that the recipient has visited "more than 30 illegal Websites," presenting him with a "list of questions" he must answer. The whole thing is, of course, a fiction inteded to lure the reader into opening the attached .ZIP file so that the worm can spread to his PC.
Sober.X e-mails are sent out with a variety of subject lines:
hi, ive a new mail address
Mail delivery failed
Paris Hilton & Nicole Richie
Registration Confirmation
smtp mail failed
You visit illegal websites
Your IP was logged
Your Password
Only Microsoft Windows platforms are vulnerable to Sober.X.
Symantec offers removal instructions and updated virus definitions to help combat Sober.X.