68.38.159.161 and 65.95.193.138 seem to be the last two standing unless ICMP is turned off on some of the other servers/pc's.
> Because that really wouldn't matter, the theory is that the infect > machines are going to get their instructions from these 20 masters > servers and then launch a distributed attack on the root DNS > servers......1 minute left > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Mellott, Bill > Sent: Friday, August 22, 2003 12:01 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > well's that where My q came in....Chris even put up a piece which said > they new about 20 servers ..18 OFFL, 2 ONL > > so then they have ID'd these things right? why not publish the IP and/or > the domain names ..so people could block these too... it just say's > about UDP port ..couldnt that also change on the fly? > > bill > > -----Original Message----- > From: Steck, Herb [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 2:59 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > wouldve been nice for them to publish the IP list so we could block it > from our firewalls. Incoming and outgoing. > > -----Original Message----- > From: Christopher Hummert [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 1:52 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > If only Arnold wasn't running for governor. We could send him back in > time to stop Skynet. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Steck, Herb > Sent: Friday, August 22, 2003 11:52 AM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > As if we all didn't have enough to do? > > -----Original Message----- > From: Matt Plahtinsky [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 1:51 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > T-minus 10 minutes ..... Its the end of the world run for your > lives................... > > -----Original Message----- > From: Sagert, Lori [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 2:41 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > Yes it is. Since we are not sure what the payload is, we patched for the > new MDAC security patch. Hey, who knows? Better to be safe than sorry. > > T-minus 20 minutes..... > > -----Original Message----- > From: Christopher Hummert [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 2:33 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > Oh crap, I didn't think that anyone actually hooked Skynet up to the > internet. > > T-Minus 30 minutes > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Matt Plahtinsky > Sent: Friday, August 22, 2003 11:33 AM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > Here is some more info on it. Should be an interesting afternoon. > > http://www.theregister.co.uk/content/56/32475.html > > http://story.news.yahoo.com/news?tmpl=story&ncid=1211&e=1&u=/nm/20030822 > /tc_nm/tech_internet_virus_dc&sid=95573372 > > -----Original Message----- > From: Lori Sagert [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 1:56 PM > To: Exchange Discussions > Subject: Sobig.F alert > > > FYI... > > http://www.f-secure.com/news/items/news_2003082200.shtml > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang > =english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > "The information transmitted is intended only for the person or entity > to which it is addressed and may contain proprietary, confidential > and/or legally privileged material. Any review, retransmission, > dissemination or other use of, or taking of any action in reliance upon, > this information by persons or entities other than the intended > recipient is prohibited. If you received this in error, please contact > the sender and delete the material from all computers." > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang > =english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > "The information transmitted is intended only for the person or entity > to which it is addressed and may contain proprietary, confidential > and/or legally privileged material. Any review, retransmission, > dissemination or other use of, or taking of any action in reliance upon, > this information by persons or entities other than the intended > recipient is prohibited. If you received this in error, please contact > the sender and delete the material from all computers." > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang > =english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
