Re: Newbie sobig worm

[MKlinke <mklinke axsi com>]

On Monday 01 September 2003 10:39, Sheila R. White wrote:
> sendmail/redhat 7.2
>
> I am trying to understand the theory.
>
> We were hit with sobig worm.
>
> Client are win/98 outlook express users.
> 1. 5 individuals were affected.
> 2. these 5 have their email posted on the company website.
> 3.no one else had evidence of the worm. (500) users.
> 4. inflex is sending admin emails indicating these same 5 users are
> attempting to send recieve exe,pifs etc. recieving appr. 200+ alerts
> per day.
>
> is there something i am missing or should be looking for/
>
> thanks


If this link doesn't help fill in some of the blanks, perhaps you can 
re-phrase your question as it's been a long weekend and I'm not sure I 
understand what you're asking.

http://securityresponse.symantec.com/avcenter/venc/data/w32 sobig f mm html

Regards,  Mike Klinke