Julia Thompson wrote:
>
> David Hobby wrote:
> >
> > ...
> > > > > I'm talking about sobig.f.
> > > > >
> > > > > I've been noticing that I don't get any messages with it overnight, but
> > > > > at some point during the morning, I start getting a whole bunch. And
> > > > > then they drop off suddenly at some point during the evening. Anyone
> > > > > else seeing this? Anyone *not* seeing this?
> > > > >
> > > > > Just curious....
> > > > >
> > > > Exactly the same here.
> > > >
> > ...
> >
> > So what you are seeing is bursts of emails sent out by
> > new infections? It takes a person going through their email to
> > produce a new infection, and after that the worm emails like mad
> > for an average of a few hours until someone figures out what is
> > going on.
> > I saw bursts, but can't remember the time of day they
> > happened.
>
> It's happening at the same time of day every day. I'm wondering now if
> there is just *one* person, or a very few number of people (5 max), that
> *I* am getting them from, and that they just go to work or whatever,
> fire up the computer, and it starts sending things out. The timing
> would be right for someone working on the west coast of the U.S.
BINGO! I hadn't emptied my trash folder in awhile, and was able to go
check headers on all the e-mails containing the virus that I'd received
today. ALL of them went through the same mail server:
BUZZ (hsc47-152.med.utah.edu [155.100.47.152])
So, I guess the thing to do now is to contact the postmaster for that
mail server and let them know they have a user sending out lots of
copies of the virus, and see if they can track it down. (Unless someone
has a more constructive suggestion.)
Julia
_______________________________________________
http://www.mccmedia.com/mailman/listinfo/brin-l
