Comments on: Latest Sober threatens e-mail gateways

Worm is generating a flood of e-mail traffic, which could hit corporate systems like a mini denial-of-service attack.

[Mr. Network]

We're looking good

Our sonicwalls are bouncing all of them and we're only at about 30% CPU usage which is normal for us.

Bouncing to whom?

If you're bouncing to the sender address, you're as much a problem as the virus itself.

Bouncing to the sender's IP address Mr. Network smart-guy? The virus does not ACCEPT mail.

So unless you a REJECTING the mail in the SMTP dialogue as it is coming in and/or discarding it, you are part of the problem...

[n3td3v]

Media hype again

While this is a threat, its not going to budge corporate infrastructure. Why don't journalists phone up corporations and ask them how badly affected they are on virii, instead of listening to AV vendor's who are reading data from honey nets.

[Mr. Network]

Not really

Having worked for some Fortune 5 companies I can tell you the littlest mailer worm like this can bring corporate networks to a standstill, delaying legit emails up to 48 hours. It's a big deal for large corporations, but not so bad for us

[Tomofumi]

A quick fix...

just add the below lines into your sendmail /etc/mail/access file to block this virus, then you are free from attack:

[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT
[e-mail] REJECT

[marykn]

Configuration

I would love to try this, but I don't know how. Can you help me? All of a sudden, I'm getting 100s of e-mails a day in Yahoo. I hardly ever had it before. I've checked for a virus and nothing shows up, but I must have something on my computer that I can't get rid of.

[CMatrix]

Hello? Mail server virus scan anyone?

Why is it ISPs can't just run a simple virus scanner to delete (or better yet report to the originating IP) these viruses before they enter users' mailboxes? The domain hosts I use all do this and I only get a few initial email borne viruses when they are just released.

[jfosdick]

Sober Worm Virus

Since November 23, I have received 122 of the type messages noted in the CNET articles. I have not opened any of the attachments. I called my service provider but they couldn't give me any info on how I get them to stop coming to my email inbox. They are still coming but now my Norton Anti-Virus software is deleting the attachments. Will they ever stop???? Joan Fosdick

[duc900rider]

W32 Sober x virus atack on symantec files

My live update kept saying no connection, I manually downloaded the latest signature file and scanned and Norton AV said it found the W32 sober x variant on a few files including the LUall.exe file but it could not fix them. I had to download a special tool from the synmantec site to fix it.