UPDATE YOUR ANTI-VIRUS SOFTWARE!

Bat · Post by **Bat** » Tue Aug 12, 2003 3:18 pm

The blaster worm is causing absolute havoc here and everywhere else by the sounds of it.

AVG can be downloaded from www.grisoft.com for free.

Seriously, this is the worst virus I've ever seen

Post by **Kajun** » Tue Aug 12, 2003 4:09 pm

Work just phoned me up (I'm on holiday) to ask me what version of Windows they're fucking using, so they could follow the right set of instructions (as opposed to XP). Like you wouldn't notice the massive

WINDOWS 2000 boot screen.

Post by **Kajun** » Tue Aug 12, 2003 4:27 pm

Shifted for wider notification (ROTFL).

Bat · Post by **Bat** » Tue Aug 12, 2003 9:05 pm

Buggers!

My boss picked a good day to be sick today!

The situation was not help, in fact turned into a shit storm by the fact that Sophos(thanks Oxford Uni for choosing the worst virus package I have ever used) quietly stopped updating the virus definitions on our server some time ago leaving all the staff and college owned machine totally unprotected

LoKi__ · Post by **LoKi__** » Wed Aug 13, 2003 10:10 am

this virus is a fucking bastard and if they ever find the cunt who wrote it i`m voting for castrating by spoon followed by him being slowly devoured by hungry rats

oh just in case you hadn`t guessed i work in a large multinationals IT department who is getting hammered by this thing

Post by **Kajun** » Tue Aug 19, 2003 11:43 am

Spectacular.

BBC Article

The Welchi or Nachi worm is using the same trick as last week's disruptive MSBlast virus to travel around the net but tries to fix vulnerable machines rather than exploit them.

The Nachi worm tries to automatically apply the software patch issued by Microsoft to secure machines against the attentions of MSBlast.

If the Nachi virus finds the MSBlast worm on a PC it removes the malicious program.

Bat · Post by **Bat** » Tue Aug 19, 2003 11:51 am

This thing is still causing chaos people. Several new variants have been released including one that may spread via port 80 rather than 135 and 4444. The fact that Microsoft are withdrawing MSN Messenger apart from the latest version and being rather cagey about it suggests that it spreads that way too.

I'm also finding that somehow the bastard thing can uninstall windows updates and certain antivirus even after a machine appears to be clean.

Be vigilant!

Post by **Kajun** » Tue Aug 19, 2003 12:49 pm

W32/Sobig-D is currently having great fun with out network.

LoKi__ · Post by **LoKi__** » Tue Aug 19, 2003 1:43 pm

The one that attempts to fix MSBlaster, yeah nice idea, problem is it floods networks with ICMP packets (PING`s essentially) and kicks the hell out of firewalls!

oh i`m sooo enjoying work at the moment

the joy of Patching servers

Bat · Post by **Bat** » Tue Aug 19, 2003 6:41 pm

Builiding a firewall was one of those things we've been meaning to do for ages. Ended up doing it in an afternoon last Friday. Discovered over the weekend that the services didn't like being restarted remotely and promptly killed the network for a while. Bah, DHCP leases are over rated anyway

Ice · Post by **Ice** » Tue Aug 19, 2003 7:03 pm

<pats Zone Alarm and NAV2002...>

Not having any problems whatsoever here

Charmaka · Post by **Charmaka** » Tue Aug 19, 2003 11:10 pm

<pats router with hardware firewall and non-MS mail client>

Same

Bat · Post by **Bat** » Wed Aug 20, 2003 5:44 am

Fair play lads, but still keep an eye out. I doubt you're firewalling port 80.

Post by **Kajun** » Wed Aug 20, 2003 10:14 am

Interesting stuff from Sophos

Sophos has received reports of thousands of instances of the Sobig-F worm (W32/Sobig-F) which can spread via email or network shares. For the worm to spread this fast, Sophos believes that the virus writer may have launched it using spamming technology. When arriving via email the worm can pose as an attached PIF or SCR file. Launching the attached file infects the computer.

"We have seen such a large influx of reports so quickly, it seems likely that the virus author gave his creation a kickstart using techniques usually employed by spammers. The result is that hundreds of thousands of copies of the Sobig-F worm are shunting around the internet, and some companies are finding their email systems are grinding to a halt," said Graham Cluley, senior technology consultant, Sophos Anti-Virus. "Many users know to be cautious about running unsolicited EXE files, but they should be equally wary about running PIF files or screensavers. All computer users should exercise caution when deciding what is safe to run on their computers."

Subject lines used are taken from a list, including "Re: That movie", "Re: Wicked screensaver", "Re: Approved" and "Your details". Like other variants of Sobig, the worm is programmed to stop working on a particular date; in this case, 10 September, 2003.

"Putting a 'dead-date' on his viruses suggests that the Sobig author is effectively test-driving his creations to see which tricks work best from the technical and psychological point of view," continued Cluley. "Releasing Sobig variants on different days of the week, and using slightly different subject lines and filenames, suggests that the worm's author may be trying to find the 'perfect' conditions under which his viruses can spread most quickly."

It's the fact that the variant spoofs e-mail addresses that's getting to us; only a few machines are infected over the network, but almost everyone's receiving mails back from mailer daemons saying they've passed on a virus, even though they never received it originally. Which is nice for support staff.

Post by **Kajun** » Wed Aug 20, 2003 11:20 am

Net craft article

On Friday Microsoft changed its DNS so that requests for www.microsoft.com no longer resolve to machines on Microsoftâ€™s own network, but instead are handled by the Akamai caching system, which runs Linux.

Hehe. It's all got to be worth it just for that.

The side effect is that some Passport-related URLs now pop up a Security Alert saying "The name on the security certificate is invalid or does not
match the name of the site".

says El Reg.

Post by **Kajun** » Thu Aug 21, 2003 8:08 am

According to managed services firm MessageLabs, the ratio of viruses to email has reached one in 28 - the same level reached at the height of the Love Bug epidemic.

MessageLabs technicians report that it has blocked over one million contaminated emails since the start of the Sobig-F epidemic. If anything the worm is growing in prevalence as time goes on, they report.