TechRepublic.com
http://techrepublic.com.com/5100-6264_11-5065898.html?tag=ft

Blaster, Welchia, and SobigF pose triple threat to networks
August 20, 2003 | John McCormick | E-Mail



Rating: 5 / 5 | Rate this article
Discussions: 1 Post(s) | 1 NEW | View posts


Malicious intruders plus vulnerable networks and buggy software equals a security nightmare. Sleep better by subscribing to Builder.com's Development Security Spotlight e-newsletter. Each Tuesday, security expert John McCormick will provide you with the latest methods for keeping your development environment safe. Sign up instantly!




After several months of relative calm on the virus front with only low-level threats, last week the Blaster worm assaulted many networks and wreaked havoc on a lot of PCs. This week, the Welchia worm—which is actually supposed to remove Blaster—arrived and began causing additional problems. Not only that, but a hot new version of the old Sobig mass-mailing worm has turned lethal and begun infecting many systems with its own brand of mischief.

ah, sorry, won't do it again.. just thought some might like to read this

Yes, we all know we should have anti-virus protection on our machines IPlural. I personally also already use a spam filtering application, but without manually configuring it to recognise the messages I spoke about above it's pretty much useless for the average user in this situation. There's also the added problem that by filtering out the 'undeliverable mail' and assorted other mails, you lose the ability to tell if your legitimate mail has reached its destination. Many spam filters also only work once mail has been downloaded to a user's machine, which is something of a problem when you have around 30Mb of mail per day generated by the Sobig virus to download on a 56k connection.

Also, what is the point of copying and pasting the marketing blurb for these products here? A simple 'try McAfee SpamKiller' or 'try Norton Internet Security' would suffice.

grayhaze: Yeah. Having a public e-mail address can cause that. But some people do not want to give in on the virii/worms/spams. But I agree that once you have your inbox filled with it then it is hard to get rid of it. But there is nothing wrong to try to prevent it in the future. And as IPlural pointed out there are several products that can assist you in that. Too bad we need to pay for that. The ISP subscription which I have includes anti-virus and firewall software. They also offer a spam protection. That helps.

grayhaze: I was responding to post #54. Hehe. You people even write faster than I can read.

actually I did mention those a number of times and yet was lambasted for being less than able to conceptualize or comprehend the situation.

evidently just pointing out those programs with a short comment exscaped some peoples eye.

as far as it goes, in the end if all you can do is filter your email for the next couple of days untli people get things cleaned up, then that is what has to happen sad to say but at the same time there are key constants about each one that is running around which you can very well filter out with a filter you create or an update that the respective programs company has created.

also you can filter out the unable to send errors and turn off return confirmations upon read in your email program.

amoung other things...

MadIce, exactly so on the ISP filtering.. that is on the IT end of things though and if they fell down on this it is a personal choice to continue service with them though because of the dynamic nature of the net, it is extreamly hard to play catch up on the IT end of things right in the middle of a situation such as this.



I remember when the worst thing you had to face was people sharing floppies

Your Computer is Stoned
Ambalance
Chars falling off the screen to pile up on the ottom of the screen
Displayed screen melting on you
Or the simple removal of the "C" from the ascii table on programmable keyboards...

anyway...

hope everyone gets this under control, good luck

Until now I have escaped e-mail virii/worms/spam, but to be secure I have just activated a spam filter and subscribed to a virus filter. Both are ISP filters. There are several options for the spam filter, but I have chosen to send it to another e-mail address (which was activated by my ISP for this purpose). They advised me to use their web-mail client or use a regular e-mail client with a virus filter. It turns out that the new virus filter can handle two POP accounts, so I added the second one to the spam account. Sounds good. Let's see what happens.

It appears this latest email problem times out in a week or two and will ultimately cease to propagate....

It appears this latest email problem times out in a week or two and will ultimately cease to propagate

Until the next version is released................

This isn't a solution to the problem, but it might help. Get hold of a 'lite' email checker (I use 'Poptray') which just lists the message headers on the mail server. You can then set rules to automatically delete the appropriate ones (which all seem to have one of about ten different headers) or delete them by hand. You can then launch your email client afterwards. That way the spam messages never get to your PC.

MailWasher does the same thing (But you can also look at the whole message still
on the server before deleting it).  You can set it to bring up your mail
client as soon as it is done processing mail.  Quite handy until you set
4,000 email a day to sort through

goodmorphing, no we are not all screwed...

I meant to say that we are all screwed even if we never ever get a virus. Internet traffic is slowed, businesses are blocked all over the place. Huge numbers of man hours are expended in purging the viri, cleaning their spam loads, repairing systems. I am sure that eventually some cost from this is going to filter down to everyone. I read last night that some college campus has blocked all e-mail access through its servers while it tried to delete them. That means all the students and all the family and friends who communicate with them are affected.

It appears this latest email problem times out in a week or two and will ultimately cease to propagate....

I read this on MSNBC this morning...

Computer security experts were racing Friday to beat a 3 p.m. ET deadline to find and disconnect 20 computers from the Internet, a defensive move aimed at preventing the Sobig.F virus from unleashing a second — and perhaps more sinister — round of havoc.

THE VIRUS, which already has tormented companies and personal computer users by becoming the fastest e-mail outbreak ever seen, contains code that instructs infected computers to download an unknown program on Friday between the hours of 3-6 p.m. ET, said Chris Belthoff, senior security analyst with the antivirus firm Sophos. He said it is unclear what that program is, or what it might do to machines infected with Sobig.F.

*****

Another Sophos official, Carole Theriault, said the program also could be as innocuous as “a smiley face dances (that) across your screen.” But even if that’s the case, the sheer volume of Internet data converging on the 20 computer targets could significantly affect Internet performance.
The virus’ secret programming for a second phase was discovered late Thursday, when analysts found code within Sobig.F instructing infected machines to make contact with the 20 computers during the three-hour window on Friday and again from 3-6 p.m. ET on Sunday.


[Message Edited]