Page 1 of 2 12 LastLast
Results 1 to 10 of 18

Thread: SoBig.F. Please read.

  1. 08-21-2003, 05:47 PM #1
    Skraggy_uk
    Skraggy_uk is offline
    FLAC Skraggy_uk's Avatar
    Join Date
    May 2002
    Location
    Warrington UK
    Posts
    1,484
    Send a message via ICQ to Skraggy_uk

    SoBig.F. Please read.

    Who's been hammered by this today?
    In the last 24hrs I've recieved over 130 mails infected by it, plus 26 bounces containing faked address's supposedly from me (my system and the server, and every other PC on my homenetwork is clean, Natted, and firewalled.

    Most the messages have incomplete headers.
    but a 5 of the bounces that included the full headers included the server name MARGI, and an AT&T owned IP address.

    Address is 12.207.156.209

    Looks to be part of a Dialup/Dynamic connection pool.

    Any one recognise that IP, if you do, check your system very carefully.
    I'm not pointing and blaming, just trying to help you sort things out, if it is you.
    4x4 in a turbo stylee.
    Reply With Quote Reply With Quote
  2. 08-21-2003, 06:40 PM #2
    gizmomkr
    gizmomkr is offline
    Maximum Bitrate gizmomkr's Avatar
    Join Date
    Dec 2000
    Location
    Smyrna, Ga, USA
    Posts
    778
    Send a message via AIM to gizmomkr
    Well you know its the fastest spreading computer virus to date.

    You just might get a couple of copies of it. Are you saying someone that reads this board has it - I wouldnt doubt it; Whats your point ?

    Yes its a huge pain in the *** to hit delete. Sys admins across the nation have people screaming down there throats - and they have hundreds of client machienes to clean, in addition to a way over worked server trying to cope with all the traffic.

    Just be glad the worm doesnt attack your file system and delete data.
    Gizmo-
    Techonlogy on Wheels
    http://www.hjnetworks.com/car
    Reply With Quote Reply With Quote
  3. 08-21-2003, 07:16 PM #3
    Blop
    Blop is offline
    Variable Bitrate
    Join Date
    Jul 2003
    Location
    Earth
    Posts
    359
    Quote Originally Posted by gizmomkr
    Well you know its the fastest spreading computer virus to date.

    You just might get a couple of copies of it. Are you saying someone that reads this board has it - I wouldnt doubt it; Whats your point ?

    Yes its a huge pain in the *** to hit delete. Sys admins across the nation have people screaming down there throats - and they have hundreds of client machienes to clean, in addition to a way over worked server trying to cope with all the traffic.

    Just be glad the worm doesnt attack your file system and delete data.

    Compare this to a network of 5000 machines being off line for 3 hours today and then consider yourself lucky......

    Sobig.F and something else....Nachi bought are network to its knees
    Reply With Quote Reply With Quote
  4. 08-22-2003, 02:24 AM #4
    Skraggy_uk
    Skraggy_uk is offline
    FLAC Skraggy_uk's Avatar
    Join Date
    May 2002
    Location
    Warrington UK
    Posts
    1,484
    Send a message via ICQ to Skraggy_uk
    I know it isn't a problem to hit delete. But if someone has it, and doesn't know, (and it uses it's own SMTP engine so why would you other than the internet gets a bit slow if you are using it while it bulk mails silentley) wouldn't they want someone to tell them and fix it?
    4x4 in a turbo stylee.
    Reply With Quote Reply With Quote
  5. 08-22-2003, 04:18 AM #5
    Blop
    Blop is offline
    Variable Bitrate
    Join Date
    Jul 2003
    Location
    Earth
    Posts
    359
    The University network is sooooo pooooo if you sneeze it will fall.
    Reply With Quote Reply With Quote
  6. 08-22-2003, 06:38 AM #6
    Skraggy_uk
    Skraggy_uk is offline
    FLAC Skraggy_uk's Avatar
    Join Date
    May 2002
    Location
    Warrington UK
    Posts
    1,484
    Send a message via ICQ to Skraggy_uk
    Quote Originally Posted by gizmomkr
    Well you know its the fastest spreading computer virus to date.

    You just might get a couple of copies of it. Are you saying someone that reads this board has it - I wouldnt doubt it; Whats your point ?

    Yes its a huge pain in the *** to hit delete. Sys admins across the nation have people screaming down there throats - and they have hundreds of client machienes to clean, in addition to a way over worked server trying to cope with all the traffic.

    Just be glad the worm doesnt attack your file system and delete data.
    Thing is, I'm not infected.
    But for my poor old Pentium pro mail and web server and NAT router, even the few hundred it has handled in the last couple of hours is tough for it.

    It's all incoming, and bounce messages.
    I must have had 10 from each address now, and just like mine in the bounces, they are probably fake (the real sender that is).
    4x4 in a turbo stylee.
    Reply With Quote Reply With Quote
  7. 08-22-2003, 06:45 AM #7
    hijinks21
    hijinks21 is offline
    Raw Wave hijinks21's Avatar
    Join Date
    May 2002
    Location
    Albany, NY
    Posts
    1,803
    Send a message via AIM to hijinks21
    i keep graphs of cpu performance of our mailserver and when sobig hit there was a 700% jump in CPU usage. this is for a small company of 10 people mind you. I'd hate to be an admin of a big network.
    '98 Explorer Sport
    http://mp3car.zcentric.com (down atm)
    AMD 800mhz 192megs RAM 60gig hard drive 9 inch widescreen VGA
    80% done
    Reply With Quote Reply With Quote
  8. 08-22-2003, 09:04 AM #8
    mp3z24
    mp3z24 is offline
    FLAC mp3z24's Avatar
    Join Date
    Apr 2001
    Location
    Chicago Suburbs
    Posts
    1,282
    perhaps this is the reason i cant get onto hotmail today....
    keeps claiming "Server too busy"

    ~mike
    Single Member of the "1000 Post and No MP3 Car" Club
    PROJECT ON INDEFINATE HOLD... BOUGHT A HOUSE
    2000 Cavalier Z24 [###-------] Only 30% Done ... Still
    Reply With Quote Reply With Quote
  9. 08-22-2003, 09:31 AM #9
    chut
    chut is offline
    FLAC chut's Avatar
    Join Date
    Jul 2003
    Location
    San Antonio, TX. USA
    Posts
    1,375
    We got pummeled by the spam that contains the "sobig" virus. It slowed down our mail server somewhat. I'm glad to say that out of 250 clients we only got three infected. I yell at our end users alot and sometimes they listen. This time they did. Interesting enough, the three that got infected were our gen mgr, a department supe and my desktop machine. I know I didn't click on the attachment so they must have infected by just opening the email.

    Take Care
    Reply With Quote Reply With Quote
  10. 08-22-2003, 10:54 AM #10
    hijinks21
    hijinks21 is offline
    Raw Wave hijinks21's Avatar
    Join Date
    May 2002
    Location
    Albany, NY
    Posts
    1,803
    Send a message via AIM to hijinks21
    chut yes.. thats why you never use Outlook
    '98 Explorer Sport
    http://mp3car.zcentric.com (down atm)
    AMD 800mhz 192megs RAM 60gig hard drive 9 inch widescreen VGA
    80% done
    Reply With Quote Reply With Quote
Page 1 of 2 12 LastLast
« Previous Thread | Next Thread »

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules