W32.sobig surge

[dbdg]

Anyone else noticed this?

Just got back from work and luckily received 78 emails with W32.sobig lovingly attached.

[The PIT]

Have I noticed it. Yeh loads of calls to our helpdesk. Can't the dumb users run a virus check before calling. NO. You'd think after the blaster they'd know how too. Even better some still haven't been updating despite all the problems of the blaster virus.
Quite a few few dumb Mac users think they've got since they've been spammed. Since they're not running virtual pc theres no way they can have it. But no since they've got an email they must be infected.
I think we need to run an awareness cause and when they interview make sure the user knows how to use a pc.

[Tjalfe]

we had 4 such emails this morning...

[Dr Mordrid]

Not here. Seems Comcast is filtering them.

Dr. Mordrid

[dbdg]

Quite funny really cause if there were no dumb users there wouldn't ever be a virus problem.

Should use it as a culling method, anyone that actually gets a virus on the PC should be culled there by reducing the population.

Still getting a couple more emails with sobig attached every hour or so, hopefully it won't conitune tomorrow, each one is 100 blooby kb.

[omegaRED]

Yep, got around 40 in my inbox today...

[The PIT]

Not all users are dumb. Some know what to do and just been away and haven't had a chance to apply the patch. Since it msblast infects so quickly it infects them before they install the patch and do the other outstanding updates.
We had one stroppy student who thought downloading the patches was all she needed to do. Personally I would have told her to get lost since we're not supposed to work student pc's that are not supplied by the University.

[GNEP]

I dunno if it's related, but I have had a load of messages (on top of the usual spam) to my hotmail account recently titled "user unknown - email subsystem" or something like it. Haven't looked inside 'cos I don't use the account other than for signing up online purposes, but maybe...


Nothing in my real emails, cos they're not widely circulated.

[Fat Tone]

Our departmental admissions email address (which as you can imagine is seeing a lot of genuine email at this time of year) is getting swamped at the moment (including the type you describe George). I must have seen 80 in the last 18 hours. I think they are all coming from the home PCs of prospective students. Boy are they gonna get educated when I see them in September.

T.

[GNEP]

You tell 'em Tony

[Fat Tone]

LOL - just watch me!

T.

[Paulr]

We've had approx. 120 messages to our info@ & sales@ addresses over the past two days.
Pretty amazing figure, the antivirus system has more than paid for itself over the past couple of weeks.

[dbdg]

Well hoping no more today but in total I had 82 through my site yesterday, please no more, please

Find out in about an hour when I get home.

Only 55 today so at least it is slowing down.

[High_Jumbllama]

Originally posted by The PIT
Not all users are dumb. Some know what to do and just been away and haven't had a chance to apply the patch. Since it msblast infects so quickly it infects them before they install the patch and do the other outstanding updates.
We had one stroppy student who thought downloading the patches was all she needed to do. Personally I would have told her to get lost since we're not supposed to work student pc's that are not supplied by the University.

The patch was out about three weeks before the virus. That's not enough time?

[The PIT]

High it depends on how long they're away for. Postgrads can be away for a long time as can Profs etc.

We've got two machines on the network with sobig.f. Over 120 with varients of msblaster and nachi virus.

I've looked at seven machines today. Two were patched up and up todate. I checked while I was in the office.

Two were unpatched despite autoupdate installed on one of them. One the user claimed she had cleaned but no patches were installed and the virus checker was six months out of date.

Two were patched but system restore was left on and kept on restoring the virus. Since the machine didn't crash the users were unaware they had a problem.

Oh Nachi virus or whatever is called isn't patching the windows on the ones I've seen.