The Sober.P worm stopped spreading on Tuesday because the virus writers remotely altered the worm to temporarily stop spreading. The worm included a few lines of code to make it respond to instructions posted on several websites.
Antivirus company F-Secure saw the worm drop to one percent of virus activity on Tuesday morning from 40 percent of virus activity on Monday — although rival antivirus company Sophos had reported that Sober.P was 84 percent of virus activity on Monday.
It's unclear why the creators of Sober.P updated the worm code to stop spreading. More info ZDNet