Discussion Locked

Question on the Sober.I worm

0 helpful

3 replies

by sfath Dec 16, 2004 last reply Dec 16, 2004

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a client that is receiving all kinds of emails that fit the description of the Sober.I worm. All anti-virus patterns are up to date and I ran the removal tool from Symantec with no virus found. The emails keep coming. Looking at the Internet Header information the originating IP is from a local contact. The contact said the IP is assigned to his group but it is not in use??? Will the worm spoof an IP address as well as the sender?

3 replies

by dustyd Dec 16, 2004

No, IP addresses in the header will not be spoofed. Have the contact run the removal tool available from Symantec.
For details and to confirm the infection, go here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sober.i@mm.html

Of course, you have to get them to 'fess up to having the IP address and an infection, which they may not want to admit, but if they're at all concerned, they will probably proceed with the removal.

by sfath Dec 16, 2004

Thanks, just what I thought but wasn't sure. So many new virus and worms! The hard part will be the 'fessing up part'

Thanks again

by sfath Dec 16, 2004

This question was closed by the author

This discussion is closed to new replies.

3 replies

Trending Desktop posts

How to make light speed agent go away

Floppy drive wont work on my 486

What Matters More in a Business Network: Hardware or Network Design

Ryzen 7 7700

Issue fully resetting my PC