Another Sober.y reminder
f-secure.com has another warning for us about the pending awakening of the sober worm. From reports it’s expected to start looking for sites to download from January 5th into January 6th. There is an extensive list of URL’s to block. This from f-secure.com – if you’re in charge of block lists at a network, this could be a good start to make sure you don’t have any clients pulling a new version from the following sites…
people.freenet.de/zmnjgmomgbdz/
people.freenet.de/smtmeihf/
people.freenet.de/qisezhin/
people.freenet.de/fseqepagqfphv/
people.freenet.de/urfiqileuq/
people.freenet.de/wjpropqmlpohj/
people.freenet.de/mclvompycem/
scifi.pages.at/zzzvmkituktgr/
home.pages.at/npgwtjgxwthx/
free.pages.at/emcndvwoemn/
home.arcor.de/ocllceclbhs/
home.arcor.de/dixqshv/
home.arcor.de/srvziadzvzr/
home.arcor.de/nhirmvtg/
home.arcor.de/jmqnqgijmng/
Second tier choices for the worm are here…..
people.freenet.de/mookflolfctm/
people.freenet.de/aohobygi/
people.freenet.de/wlpgskmv/
people.freenet.de/svclxatmlhavj/
people.freenet.de/jpjpoptwql/
people.freenet.de/iohgdhkzfhdzo/
people.freenet.de/eetbuviaebe/
scifi.pages.at/vvvjkhmbgnbbw/
home.pages.at/twfofrfzlugq/
free.pages.at/sfhfksjzsfu/
home.arcor.de/qlqqlbojvii/
home.arcor.de/fulmxct/
home.arcor.de/fowclxccdxn/
home.arcor.de/lnzzlnbk/
home.arcor.de/rprpgbnrppb/
people.freenet.de/iufilfwulmfi/
people.freenet.de/xbqyosoe/
people.freenet.de/nkxlvcob/
people.freenet.de/svclxatmlhavj/
people.freenet.de/bnymomspyo/
people.freenet.de/jbevgezfmegwy/
people.freenet.de/gdvsotuqwsg/
scifi.pages.at/eveocczmthmmq/
home.pages.at/doarauzeraqf/
free.pages.at/hsdszhmoshh/
home.arcor.de/dyddznydqir/
home.arcor.de/iyxegtd/
home.arcor.de/oakmanympnw/
home.arcor.de/riggiymd/
home.arcor.de/jhjhgquqssq/
The first list seems highly likely, the second list, according to f-secure…
These additional addresses might be produced by the URL algorithm in certain rare conditions.