Thanks for the heads-up, Kris. We have applied filter rules to all of our Internet routers to block all outbound IP access to the IP addresses listed below and to block all outbound udp access to port 8998.
Bill ----- Original Message ----- From: "Kris Rickerson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, August 22, 2003 10:33 AM Subject: RE: [Declude.Virus] Sobig- Phase II bombardment > > > > >It would seem to me that someone's decoded this encrypted list and if we > >knew what it was we could setup access lists to block connections to the > >20 machines. > > Ask, and you shall receive. > > ------------------ > > Subject: ISS Security Brief: Sobig.F Second Phase Action > > -----BEGIN PGP SIGNED MESSAGE----- > > > Computers infected with the Sobig.F worm are programmed > to automatically download an executable of unknown function > from a hard-coded list of servers at 19:00 UTC (3:00pm EDT) > X-Force is recommending wholesale outbound filtering of > the following IP addresses: > > 67.73.21.6 > 68.38.159.161 > 67.9.241.67 > 66.131.207.81 > 65.177.240.194 > 65.93.81.59 > 65.95.193.138 > 65.92.186.145 > 63.250.82.87 > 65.92.80.218 > 61.38.187.59 > 24.210.182.156 > 24.202.91.43 > 24.206.75.137 > 24.197.143.132 > 12.158.102.205 > 24.33.66.38 > 218.147.164.29 > 12.232.104.221 > 68.50.208.96 > > The request method uses UDP port 8998. X-Force also > recommends that this port be filtered outbound. > > > > Kris Rickerson > Server Administrator > Middle Georgia College - Cochran, GA 31014 > [EMAIL PROTECTED] > ------------------------------- > "This is the material, by the way, that has kept me virtually anonymous in > America. Meanwhile, they're draining the Pacific and putting up bench > seats for Carrot Top's next Showtime special. Carrot Top -- for people who > didn't get Gallagher. Gallagher -- the comedian who made his name by > destroying good food with a sledge hammer at the end of his show. Gee, I > wonder why we're hated the world over?" - Bill Hicks (1961-1994) > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
