[clug] port 80 probes

[Ian Matters]

Read the following:

Ian Matters.
---
===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                         AL-2003.14 -- AUSCERT ALERT
                   Mass-mailing virus/worm W32/Sobig.F-mm
                               20 August 2003

===========================================================================


         There is a new variant of the mass-mailing W32/Sobig virus known
         as W32/Sobig.F-mm.  Sobig.F-mm possesses a mass-mailing capability,
         attaching itself to messages, and has the ability to propagate via
         network shares similar to Sobig.E reported in AusCERT update
         AU-2003.007:

                 https://www.auscert.org.au/render.html?it=3204

         International reports indicate that Sobig is propagating rapidly.

         Email infected with Sobig.F will have a spoofed "from:" address,
         making this identification of the message origin unreliable.
         Sobig.F messages may have one of the following subjects:

                 Re: Thank you!
                 Thank you!
                 Your details
                 Re: Details
                 Re: Re: My details
                 Re: Approved
                 Re: Your application
                 Re: Wicked screensaver
                 Re: That movie

         Sobig.F attachments have a random name, chosen from this list:

                 your_document.pif
                 document_all.pif
                 thank_you.pif
                 your_details.pif
                 details.pif
                 document_9446.pif
                 application.pif
                 wicked_scr.scr
                 movie0045.pif

         The message may have one of these lines as its content:

                 Please see the attached file for details.
                 See the attached file for details

         This variant of Sobig is coded to stop replicating as of 10th
         September 2003.

         Information
         -----------

         http://www.f-secure.com/v-descs/sobig_f.shtml
         http://vil.nai.com/vil/content/v_100561.htm#VirusInfo
         http://www3.ca.com/solutions/collateral.asp?CT=27081&CID=49259
         http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100561
         http://securityresponse1.symantec.com/sarc/sarc.nsf/html/w32.sobig.f@mm.html
         http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBIG.F
         http://www.sophos.com/virusinfo/analyses/w32sobigf.html
         http://www.messagelabs.com/viruseye/info/default.asp?tabIt=rep&virusname=W32/Sobig.F-mm 


         Solution
         --------

         When possible, upgrade all anti-virus software to use the latest
         definition files as soon as they become available.

         Ensure that all network file shares are disabled unless necessary
         and if possible ensure that active shares are password protected.

         AusCERT advises members to disseminate and take action on this
         information to prevent any undesirable activity by this virus
         within their sites.

         AusCERT has produced an article "Protecting your computer from 
malicious code",
         available at http://www.auscert.org.au/3352

- ---------------------------------------------------------------------------

The AusCERT team has made every effort to ensure that the information
contained in this security bulletin is accurate at the time of publication.
However, the decision to follow or act on information or advice contained in
this security bulletin is the responsibility of each user or organisation, and
should be considered in accordance with your organisation\'s site policies and
procedures. AusCERT takes no responsibility for consequences which may arise
from following or acting on information or advice contained in this security
bulletin.

If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:

         http://www.auscert.org.au/render.html?it=3192

AusCERT maintains a World Wide Web service which is found on:
http://www.auscert.org.au.

Internet Email: auscert at auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                 AusCERT personnel answer during Queensland business
                 hours which are GMT+10:00 (AEST).  On call after hours
                 for member emergencies only.

Postal:
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld  4072
AUSTRALIA
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBP0Ka7Sh9+71yA2DNAQGP3QQAjRaeyKsRIeFWagltR+099w5SwhTLsSmP
Fg+Bg8sXGP2IelVbSvHK1zGwVjDpNQcvVAk7wGDK0eyyTItZ3s6Db7mi4Ad4XgKi
YRE+ccZbe34E8hxDH6Gem11NqiVMVcfo2gvQZUHNBWM8LJbcdXEknWSSZTqf6+du
r32S3U9rzAg=
=JH9q
-----END PGP SIGNATURE-----
_______________________________________________
Auscert-public mailing list
Auscert-public at anu.edu.au
http://mailman.anu.edu.au/mailman/listinfo/auscert-public

---
At 08:14 PM 20/08/2003, you wrote:
>What's the deal with the flood of port 80 probes I am
>seeing for the last two days? about 2400 so far since
>the morning of the 18th. It was rather quiet for the
>earlier part of the week.
>
>--
>Eyal Lebedinsky (eyal at eyal.emu.id.au) <http://samba.org/eyal/>