Looks like my upstream has killed routes the all of these....way to go ISP.
-----Original Message----- From: Scott Force [mailto:[EMAIL PROTECTED] Sent: Friday, August 22, 2003 2:09 PM To: Exchange Discussions Subject: RE: Sobig.F alert 68.38.159.161 and 65.95.193.138 seem to be the last two standing unless ICMP is turned off on some of the other servers/pc's. > Because that really wouldn't matter, the theory is that the infect > machines are going to get their instructions from these 20 masters > servers and then launch a distributed attack on the root DNS > servers......1 minute left > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Mellott, Bill > Sent: Friday, August 22, 2003 12:01 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > well's that where My q came in....Chris even put up a piece which said > they new about 20 servers ..18 OFFL, 2 ONL > > so then they have ID'd these things right? why not publish the IP and/or > the domain names ..so people could block these too... it just say's > about UDP port ..couldnt that also change on the fly? > > bill > > -----Original Message----- > From: Steck, Herb [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 2:59 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > wouldve been nice for them to publish the IP list so we could block it > from our firewalls. Incoming and outgoing. > > -----Original Message----- > From: Christopher Hummert [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 1:52 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > If only Arnold wasn't running for governor. We could send him back in > time to stop Skynet. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Steck, Herb > Sent: Friday, August 22, 2003 11:52 AM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > As if we all didn't have enough to do? > > -----Original Message----- > From: Matt Plahtinsky [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 1:51 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > T-minus 10 minutes ..... Its the end of the world run for your > lives................... > > -----Original Message----- > From: Sagert, Lori [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 2:41 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > Yes it is. Since we are not sure what the payload is, we patched for the > new MDAC security patch. Hey, who knows? Better to be safe than sorry. > > T-minus 20 minutes..... > > -----Original Message----- > From: Christopher Hummert [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 2:33 PM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > Oh crap, I didn't think that anyone actually hooked Skynet up to the > internet. > > T-Minus 30 minutes > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Matt Plahtinsky > Sent: Friday, August 22, 2003 11:33 AM > To: Exchange Discussions > Subject: RE: Sobig.F alert > > > Here is some more info on it. Should be an interesting afternoon. > > http://www.theregister.co.uk/content/56/32475.html > > http://story.news.yahoo.com/news?tmpl=story&ncid=1211&e=1&u=/nm/20030822 > /tc_nm/tech_internet_virus_dc&sid=95573372 > > -----Original Message----- > From: Lori Sagert [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 1:56 PM > To: Exchange Discussions > Subject: Sobig.F alert > > > FYI... > > http://www.f-secure.com/news/items/news_2003082200.shtml > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang > =english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > "The information transmitted is intended only for the person or entity > to which it is addressed and may contain proprietary, confidential > and/or legally privileged material. Any review, retransmission, > dissemination or other use of, or taking of any action in reliance upon, > this information by persons or entities other than the intended > recipient is prohibited. If you received this in error, please contact > the sender and delete the material from all computers." > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang > =english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > "The information transmitted is intended only for the person or entity > to which it is addressed and may contain proprietary, confidential > and/or legally privileged material. Any review, retransmission, > dissemination or other use of, or taking of any action in reliance upon, > this information by persons or entities other than the intended > recipient is prohibited. If you received this in error, please contact > the sender and delete the material from all computers." > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang > =english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: > http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; > lang=english > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] "The information transmitted is intended only for the person or entity to which it is addressed and may contain proprietary, confidential and/or legally privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
