hi, according to press releases here in germany sober.z was designed to stop spreading on 06/Jan/2006. from this date on it looks for updates of himself. internetsecuritycompanies managed to decode sober.z and published the list of addresses where sober.z would look for updates (http://www.f-secure.com/weblog/archives/archive-012006.html#00000769). maybe this stopped the author of sober.z from deploying updates of sober.z to this addresses. also there was a police action against ultra right wing people (about 3 or 4 months ago). following to this police action there were notifications about the thread of new sober-variants. so the sober-author might be hiding out right now.
but if the police don't catch him, i'm afraid he will strike again. markus -----Ursprüngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Bruce Loughlin Gesendet: Montag, 9. Januar 2006 02:35 An: [email protected] Betreff: RE: [Declude.Virus] Sober.z that was my fear... but so far we are still ok. No sober.z virus, and I have not seen a new variant either. (my old mail server needed this break!) Bruce -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Tim Collins (Home) Sent: Saturday, January 07, 2006 7:54 AM To: [email protected] Subject: RE: [Declude.Virus] Sober.z I see the same results as Bruce. On Jan 5th I had 450 hits of Sober.z. On Jan 6th I had ZERO. I'm using Fprot and have not upgraded recently... Nothing to do with the version. Maybe the calm before the storm? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J Porter Sent: Friday, January 06, 2006 9:53 PM To: [email protected] Subject: Re: [Declude.Virus] Sober.z Yep... I upgraded to FProt 3.16e and noticed the slowdown. I thought it was a problem with that version, so I upgraded to the 3.16f which was released today. Still no Sober viruses caught. I'm still wondering if I should go back to 3.16d. Anyone seeing Sober caught with these last 2 updates of F-Prot?? ~Joe ----- Original Message ----- From: "Bruce Loughlin" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Friday, January 06, 2006 10:03 AM Subject: [Declude.Virus] Sober.z > Has any one else noticed that sober.z just stopped today? > > I was getting hundreds a day and now I have 0. > Wasn't this the day it was to morph? > > Bruce L. > AFM > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses at HNB.com] > > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
