here is sobig outbound traffic we stopped at our gateway
80 deny ip any host 67.73.21.6 log (3 matches)
90 deny ip any host 68.38.159.161 log (3 matches)
100 deny ip any host 67.9.241.67 log (3 matches)
110 deny ip any host 66.131.207.81 log (3 matches)
120 deny ip any host 65.177.240.194 log (3 matches)
130 deny ip any host 65.93.81.59 log (3 matches)
140 deny ip any host 65.95.193.138 log (3 matches)
150 deny ip any host 65.92.186.145 log (3 matches)
160 deny ip any host 63.250.82.87 log (3 matches)
170 deny ip any host 65.92.80.218 log (3 matches)
180 deny ip any host 61.38.187.59 log (3 matches)
190 deny ip any host 24.210.182.156 log (3 matches)
200 deny ip any host 24.202.91.43 log (2 matches)
210 deny ip any host 24.206.75.137 log (3 matches)
220 deny ip any host 24.197.143.132 log (3 matches)
230 deny ip any host 12.158.102.205 log (3 matches)
240 deny ip any host 24.33.66.38 log (3 matches)
250 deny ip any host 218.147.164.29 log (3 matches)
260 deny ip any host 12.232.104.221 log (3 matches)
270 deny ip any host 68.50.208.96 log (3 matches)
280 deny udp any any eq 8998 log
290 deny tcp any any eq 8998 log
----- Original Message -----
From: "Jeff Maze - Hostmaster" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, August 23, 2003 4:01 PM
Subject: RE: [Declude.Virus] Sobig- The Morning After
Wow.. That's great..
What port was the machine trying to use? And what IP was the machine trying
to contact?
Just curious..
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Doug McKee
Sent: Saturday, August 23, 2003 10:27 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Virus] Sobig- The Morning After
THIS IS AN INCREDIBLE GROUP !!!!!!!!!
DECLUDE IS AN INCREDIBLE PRODUCT !!!!!!!
KUDUS to you Scott.
Grateful THANKS to all the members who contributed yesterday !
I usually delete about 2500-3000 files from the virus folder every morning.
The load in the last 24 hours was a few over 20,000.
The banname feature and the badheaders caught about a bunch.
The info received from the group allowed us to prepare and to advise our
clients for what could have been much worse than it was.
Blocking the port kept a PC somewhere in our network from doing any damage.
It made over 1200 attempts to contact a server outside our network in the
first hour. We will hunt it down and make sure it gets cleaned up.
I am honored to be a member of this group.
Sincere Thanks,
Doug McKee COO
South Texas Internet
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To unsubscribe, just
send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
