W32.Sobig.F@mm. VIRUS WARNING.

[Miket]

VIRUS WARNING

I've got it today, easy to remove, but do we need the hassle.


http://securityresponse.symantec.com...obig.f@mm.html

[osgood]

Contrary Mary

Mike, getting about 70 of these a day as from yesterday getting really pissed off!!!x( My email set up deletes the attachment and Nelly Norton quarantines it but its getting so bad I wont be able to use the confuser shortly!! :} Even getting some with the address cobraclub.com & dax.com etc Eric. :f {-}

[StuartH]

Big time hassle!! Our virus checker at work picks it up no probs (though for a time MCAfee wouldn't believe their first fix wasn't working when obviously it wasn't). Unfortunately it means I get two emails (minus the virus attachment) for every dodgy mail I recieve as the virus scanner sends me a message too so my inbox was rather packed this morning x( x(

Now I reckon that the person whose PC they are coming from is someone here (they all came from the same IP according to our administrator even though they appear to come from different people) as one of the people who it appeared to come from was Robert Stanley (apparently this virus looks through your mail box and puts addresses from it in the to/from fields as well as making up random ones)

Please get an up to date virus scanner - they are not expensive, and as Mike said we could do without the hassle!!

Stuart

[osgood]

Contrary Mary

Stuart, what you are saying is then, its someone in the Club who has that sort of knowledge?? One name springs to mind who has been very quiet lately!! Eric.

[StuartH]

>
>Contrary Mary
>
>Stuart, what you are saying is then, its someone in the Club
>who has that sort of knowledge?? One name springs to mind who
>has been very quiet lately!! Eric.

Not really - in fact very likely the opposite. It's more likely to be someone who doesn't realise the need to be careful with email attachments and keep up to date (latest updates installed) virus checkers and firewall software and has inadvertently become infected.

Not gloating by the way - it could happen to anyone, and even with up-to-date software McAfee didn't pick up the problem with the mail attachments for a good few hours (though it was obvious the emails were dodgy to my overly suspicious mind).

Annoyingly the ISP of the person who sent almost all of the infected mails to me was not able to comprehend the problem and hence block the account of the offending person until they had removed the virus
:} :}

Stuart

[robert]

Stuart

Beat me to it. :}

[robert]

You mean this one?

X-ClientAddr: 193.115.168.62
Received: from NR4HYD50J ([193.115.168.62])

[Miket]

Yes another one.


http://securityresponse.symantec.com...chnicaldetails

[COBRA KEV01]

You all took the words from out of my mouth.!!!!!!!!!!

[Jnex26]

What This one....

% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-serv...copyright.html

inetnum: 193.115.168.0 - 193.115.168.63
netname: NORTON-ROSE
descr: Norton Rose
descr: London
country: gb
admin-c: SB17223-RIPE
tech-c: SB17223-RIPE
tech-c: SB17223-RIPE
status: ASSIGNED PA
notify: ripe-notify@uk.psi.com
mnt-by: PSINET-UK-SYSADMIN
changed: sweetd@uk.psi.com 20030429
source: RIPE

route: 193.114.0.0/15
descr: EUNETGB-114-AGG
origin: AS1290
mnt-by: PSINET-MNT
changed: network-ripe@uk.psi.com 20021015
source: RIPE

person: Stephen Bartlett
address: Kempson House
address: Camomile Street
address: London
address: EC3A 7AN
address: UK
phone: +44 207 283 6000
fax-no: +44 207 283 6500
e-mail: bartlettsb@nortonrose.com
nic-hdl: SB17223-RIPE
mnt-by: JDB1-RIPE-MNT
changed: global@vi.net 19991013
source: RIPE