W32.sobig surge

[Dr Mordrid]

Finally got a surge here, but handled them smoothly;

1. set up NAV to delete virus attachments

2. the virus laden mail has a common sentence in the body:

"see the attached file for details."

I have set my spam filter to delete mail with this in the body.

Between the two legit, but infected, mail passes absent the infected attachment but the auto-mailed junk doesn't.

Dr. Mordrid

[Paulr]

That is exactly the system I'm using now.
I'm actually filtering all of the infected messages into our Spam folder so I can keep track.
Currently since 5:30pm yesterday to now (3:30pm) we've had 89 such infected messages - pretty impressive.

[The PIT]

Originally posted by Paulr
That is exactly the system I'm using now.
I'm actually filtering all of the infected messages into our Spam folder so I can keep track.
Currently since 5:30pm yesterday to now (3:30pm) we've had 89 such infected messages - pretty impressive.

89 thats nothing. One poor user had 241 delivered in one working day another 143.

[SitFlyer]

And now this

From: http://www.dslreports.com/shownews/31663

Worm carries hidden payload
Hidden attack instructions buried in the code of the prodigious Sobig.F virus has security experts scared stiff. The worm, which has been flinging junk e-mail at inboxes at record speeds this week, apparently carries an encrypted hidden payload initially overlooked by many security analysts. As a result, Sobig.F infected machines have silently synchronized their clocks with the atomic clock (Colorado's master time keeping system), and are scheduled to unpack their whallop in unison across the globe, at 3pm EST today.

t-minus 2 minutes and counting.......

[Hati]

According to F-Secure the virus will try to connect to one of 20 IP-adresses to load new destructive code today

http://www.f-secure.com/news/items/news_2003082200.shtml

A list of this adresses can be found here (german).

http://www.heise.de/newsticker/data/pab-22.08.03-000/

Heise recommends to block these IP-adresses and also block
ports 991 - 999 for incomming and port 8998 for outgoing UDP
traffic.

Hati

[The PIT]

Good hopefully it will format all the machines infected with the msblaster virus. Should take out over 120 machines on our network.

[Duty]

Over a thousand this morining alone... This sux. The company hosting our servers is working on a fix... Makes me wonder if we need to move our stuff.

Jeff

[The PIT]

Originally posted by Duty
Over a thousand this morining alone... This sux. The company hosting our servers is working on a fix... Makes me wonder if we need to move our stuff.

Jeff

Is that a thousand emails or a thousand infected machines ??

If it's infected machines your company needs to look at a new head of IT and let him/she enforce the securty on the network. Now some cigar smoking wally on the board.

[Paulr]

26th August.
Still on about one hundred infected mails a day coming in - oh the end is nigh!