Now this is more like it. F-Secure have cracked the URL generating hash in Sober.Y

Basically Sober can self-update from a URL. The author knew she couldn't use one URL to post the updated versions of Sober as that would be discovered and taken down pretty quickly. Instead she made Sober sync with an atomic clock and generate unique URLs based on the time. These URLs can be pre-computed for a certain time by the Sober author who can then register them quickly and have the infected machines update themselves.

Given that we know what days Sober activates, you too can block the URLs. They are posted at f-secure's blog.

This is exactly the kind of additional remediation malware researchers should be providing. Thanks F-Secure.

UPDATE: LURHQ has more on the many variants activation dates.