Is there a new virus storm going on? - Democratic Underground

TrogL

(1000+ posts) Send PM | Profile | Ignore

Fri Aug-29-03 05:23 PM
Original message

Is there a new virus storm going on?

I'm getting hit by porn attachments from somebody's address book.

Printer Friendly | Permalink | | Top

Maple

(1000+ posts) Send PM | Profile | Ignore

Fri Aug-29-03 05:26 PM
Response to Original message

1. Sobig was supposed

to mutate again anytime for Sobig 3

Maybe it started.

Printer Friendly | Permalink | | Top

TrogL

(1000+ posts) Send PM | Profile | Ignore

Fri Aug-29-03 05:28 PM
Response to Reply #1

2. My tech guy just called back

It's sobig all right. This will happen every weekend for awhile.

Printer Friendly | Permalink | | Top

Maple

(1000+ posts) Send PM | Profile | Ignore

Fri Aug-29-03 05:30 PM
Response to Reply #2

4. And you're one of the first..

Congrats! ;-)

Printer Friendly | Permalink | | Top

Kellanved

(1000+ posts) Send PM | Profile | Ignore

Fri Aug-29-03 05:30 PM
Response to Original message

3. At the moment lovegate_g is most active

And your description fits.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_LOVGATE.G

the map (Java-applet):
http://www.spiegel.de/netzwelt/technologie/0,1518,158384,00.html

Printer Friendly | Permalink | | Top

TrogL

(1000+ posts) Send PM | Profile | Ignore

Fri Aug-29-03 05:37 PM
Response to Original message

5. more details

I've gotten two so far. Subjects:

im back, are you
Is that really You?

the contents are identical - a link to a penis size website and medical URLS.

Printer Friendly | Permalink | | Top

TrogL

(1000+ posts) Send PM | Profile | Ignore

Fri Aug-29-03 05:39 PM
Response to Original message

6. How do I set up my router to do this?

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBIG.F

# Block port 8998 for all outbound traffic to prevent the malware from contacting the remote servers where it can download the file.
# Block ports 995 to 999 for all inbound traffic to prevent any active server from sending the dowload source to the worm.

It's a linksys.

Printer Friendly | Permalink | | Top

DU AdBot (1000+ posts)

Sat May 04th 2024, 06:11 PM
Response to Original message

Advertisements [?]

Top

Powered by DCForum+ Version 1.1 Copyright 1997-2002 DCScripts.com
Software has been extensively modified by the DU administrators

Important Notices: By participating on this discussion board, visitors agree to abide by the rules outlined on our Rules page. Messages posted on the Democratic Underground Discussion Forums are the opinions of the individuals who post them, and do not necessarily represent the opinions of Democratic Underground, LLC.