full-disclosure - Anybody know what Sobig.F has downloaded?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: strombrg at dcs.nac.uci.edu (Dan Stromberg)
Subject: Anybody know what Sobig.F has downloaded?


What if someone cranks a clock forward and sees what the program does?

Not having any windows systems at all, I'm in a poor position to try
this.  :)

On Fri, 2003-08-22 at 13:33, Compton, Rich wrote:
> As many of you know, the latest Sobig.F virus was scheduled to begin
> downloading unknown code from various IPs at 3:00 EST today on UDP port
> 8998.  Does anybody have any idea what this code is?  Are the infected boxes
> actually downloading code?  Does anybody have an infected Windoze box with
> Sobig that can see what code was downloaded?
> 
> Here's a link to some info at Sophos in case you are unfamiliar with this.  
> 
> http://www.sophos.com/virusinfo/articles/sobigextra.html
> 
> Looking at the infection rates of this virus, I'd say that it's pretty
> important that we find out what this code is and what it does ASAP!
> 
> Thanks,
> Rich Compton 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
-- 
Dan Stromberg DCS/NACS/UCI <strombrg@....nac.uci.edu>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030822/70750d19/attachment.bin