RE: Anybody know what Sobig.F has downloaded?

["Ferris, Robin" <R.Ferris () napier ac uk>]

Old News, what most of us are waiting for is the next sobig variant that
will come out after sept 10. Some have said that it will be out on the 11th
but I think that was just the AV vendors hyping things up (read Symantec,
NAI etc ) the smaller ones are more accurate. 

For info on the 2nd part go to sophos or something like that they have
documented it quite well.

RF

-----Original Message-----
From: Brent J. Nordquist [mailto:b-nordquist () bethel edu]
Sent: 01 September 2003 21:09
To: full-disclosure () lists netsys com
Subject: Re: [Full-disclosure] Anybody know what Sobig.F has downloaded?


On Sat, 23 Aug 2003, Nick FitzGerald <nick () virus-l demon co uk> wrote:

> it seems all the "contact list" machines were disconnected from the
> Internet about an hour before "come and get it" time.  One hopes this
> was done cluefully after certain important forensic evidence had been
> appropriately gathered, or at least was known to then be present on the
> machines and the machines were suitably secured for forensic analysis.

Has anyone heard anything more about that second stage; whether any of it 
was recovered, what it was supposed to be?  I can't find anyone talking 
about it; I thought this would be big news.

-- 
Brent J. Nordquist <b-nordquist () bethel edu> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html
* Fast pipe * Always on * Get out of the way - Tim Bray
http://tinyurl.com/7sti

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html