Forum Moderators: open

Message Too Old, No Replies

New Virus Sobig.f

Symantec level 3

         

Visit Thailand

2:31 pm on Aug 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I always appreciate when people post about viruses even though the AV is always up to date a heads up is always handy.

So we have received a few hundred of these in the last hour. Symantec launched sometime this afternoon (Thai time) a new live update patch as well.

[symantec.com...]

dazz

3:04 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



yeh im getting hammered by emails at the mo!

Thanks

juniperwasting

3:08 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



yeh im getting hammered by emails at the mo!

Understatement. I have just set a new record...

linkshark

5:22 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



holy cow. Never seen it so bad. Already got hundreds of these.

rogerd

7:13 pm on Aug 19, 2003 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



Ditto here... across many of my e-mail accounts, which isn't typical for this kind of thing. Usually, one or two accounts get hammered.

jk3210

7:31 pm on Aug 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Mine are coming in 60-100 at a clip.

It's too bad that they have to be downloaded. I wish we could set NAV to delete them as they are detected.

mivox

8:06 pm on Aug 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Just started getting them about an hour ago... hehehe. Mornings like this, I love my Mac even more. ;)

juniperwasting

9:58 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



Heh, just got one from techsupport@mcafee.com

Gives ya faith doesn't it..

ScottM

10:05 pm on Aug 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I agree, I am getting absolutely hammered with one-and I've never had it happen this bad before.

juniperwasting

10:19 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



I set up a rule using the common subject lines.
Sends the buggers right to my deleted box, marks them as read, and I can look through them later. Look at the symantec chart for it to get the subjects.

http:**//securityresponse1.symantec.com/sarc/sarc.nsf/html/w32.sobig.f@mm.html

Ally_Cat

10:25 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



Knock on wood, I haven't gotten one single e-mail related to this virus today.

miles

10:43 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



Whoever made it needs to have the tar kicked out of them. It is a pain in the butt and its childish behavior that needs to be corrected with a WHOOPIN.

Slade

10:50 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



Knock on wood, I haven't gotten one single e-mail related to this virus today.

Ditto. I haven't gotten anything besides spam for as long as I can remember.

Maybe I'm just not famous/important enough.

panic

10:58 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



A co-worker of mine got owned by this virus. :(

-panic

juniperwasting

11:09 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



A co-worker of mine got owned by this virus.

It tried to own me, but brains over programs everyday.
Now what was a torrent of madness is a trickle of annoyance...

panic

11:20 pm on Aug 19, 2003 (gmt 0)

10+ Year Member



It tried to own me, but brains over programs everyday.

Not always true. Blaster owned people without them having opened any emails/etc.

-panic

mivox

11:28 pm on Aug 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Choose less vulnerable/less targeted software for your email and/or operating system, and that can't happen... ;)

Visit Thailand

12:26 am on Aug 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Mivox, that is a bit like giving in to terrorists and only frequenting establishments which are owned by a country instead of b.

If everyone switched operating systems etc the virus writers would only follow the crowd.

Thankfully MS seems to be waking up to this especially after the blaster worm.

This Sobig virus is nasty in the sense that people are getting hundreds and hundreds and even thousands of the **** things. Even if you patched and up to date you are going to be affected and the bigger you are the more damage.

Something has to be done, but holes and people who do not keep their NAV's and systems up to date and patched up will always be found.

More severe punishment needs to be found for the people that write and distribute them.

mivox

12:36 am on Aug 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Mivox, that is a bit like giving in to terrorists and only frequenting establishments which are owned by a country instead of b.

Boycotts & strikes have been effective tools in *ahem* "encouraging" change in business and political policies throughout history. Ever heard of a little guy named Ghandi? ;)

If everyone started abandoning MS email software, MS might stand up, take some notice, and do a bit more to make the virus writers' "job" a little more difficult than it apparently is now.

If everyone switched operating systems etc the virus writers would only follow the crowd.

If everyone switched to the SAME alternative software, yes... a number of virus writers would follow.

BUT, if everyone switched to one or another of the MULTITUDE of email programs available today, taking some care to choose one that didn't automatically execute attachments, and/or one that didn't commune too closely with the operating system (even if you stayed with Windows), it would be awfully hard for a virus writer to write anything that would effectively exploit different weaknesses in a dozen different email programs.

Visit Thailand

12:45 am on Aug 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Of course boycotts can be effective, but as was discovored recently by many around the world certain boycotts are simply impossible, and the chances of everyone switching to numerous systems etc is highly to say the least unlikely.

Whether we like it or not MS is the dominant force in this arena and so they need to address the issue along with govts and possibly start calling virus writing and distribution terrorism.

It is definitely terrorising me at the moment.

mivox

12:55 am on Aug 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



How about just calling it "illegal" since it already is? I'd hardly call having a clogged inbox being "terrorized" by any measure... ;)

Mass email software switching? Unlikely, yes. Most people buy a computer and use whatever software it came with.

However, those of us who know better can protect ourselves and prevent ourselves from becoming part of the problem. Those of us who act as unofficial tech-support for our entire families because we're the only computer literate ones in the bunch can do our relatives a favor and help them make better software decisions, and/or become more security aware... Auto-updating anti-virus software, choosing proper security settings on the email software we choose, choosing more secure email clients, etc.

There's not much we can do beyond that. But for those who aren't even doing that much, it's like not voting and then complaining when the candidate you like doesn't get elected... ;)

Visit Thailand

2:19 am on Aug 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I agree with you Mivox.

Since this morning (3 hours ago) I have received close to 700 emails. For me that is terrorising as each time the **** thing comes in on my computer I get the NAV pop up saying a virus has been discovered etc.

Anyone know if you can turn that pop up off?

linkshark

4:36 pm on Aug 20, 2003 (gmt 0)

10+ Year Member



Anyone know if you can turn that pop up off?

NAV kill popup.

NAV > Options > Email

How to respond when a virus is found?
Repair then silently delete if unsuccessful.

This eliminates the quarantine popup for every virus laden email.

I also have email filter where every email w/ attachment goes directly to deleted items. Miss a few good ones, but getting 1000's of sobig.f lately... Oh well.

dvduval

4:42 pm on Aug 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



If everyone started abandoning MS email software, MS might stand up, take some notice, and do a bit more to make the virus writers' "job" a little more difficult than it apparently is now.

OK, I'm in a domain using Microsoft Exchange Server. What can I do as an individual? What are my alternatives?

panic

6:07 pm on Aug 20, 2003 (gmt 0)

10+ Year Member



Why do threads usually go off topic? It went from a virus alert to someone asking for a revolutionary Marxist overthrow of Microsoft. :(

-panic

mivox

7:12 pm on Aug 20, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I didn't "ask for a Marxist overthrow" of anything. I'm not a Marxist, and there's nothing Marxist about a principled product boycott in the first place. <added>The concept of "voting with your dollars" is about as capitalism/democracy-friendly as any form of activism could possibly get.</added> Asking for a Marxist overthrow would be more like asking the Microsoft employees to take over the company from the current ownership hierarchy, thankyouverymuch.

I hate it when people start throwing around political labels incorrectly in an attempt to insult or discredit someone. If you want to start throwing politically-colored insults at people, you should either use the terminology correctly, or at least refrain from using it incorrectly when talking about/to someone who spent 5 years studying political science. ;)

This thread did NOT go off topic. It turned from a simple alert message to a perfectly relevant discussion about what to do to minimize the impact viruses like this have on our daily computing needs.

It just so happens that Microsoft software is almost always the target of major email virus attacks, so the most obvious (and easiest) thing to do is to switch to an un-targeted/less vulnerable email client.

That isn't off topic (or Marxist) at all.