RE: Desperately Seeking SOBIG.F ([WEB400] FW: Thank you!)

[Mark Allen <mallen@xxxxxxxx>]

I feel so unloved, I have yet to get an email with SoBig (even on my
throw away Yahoo account!!!!)

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Eyers Daniel
Sent: Thursday, August 21, 2003 9:43 AM
To: 'Web Enabling the AS400 / iSeries'
Subject: Desperately Seeking SOBIG.F ([WEB400] FW: Thank you!)


Yeah, I know... My point was that I was getting *several* sobig.f
e-mails from folks on the list, so it seemed logical that the list had
been compromised.  Since you and I have very little interaction outside
the list, it seemed reasonable that someone on the list had been
affected.

I sent a copy of the email with your address because I felt confident
you would understand the reasoning.  I have gotten emails from Mark
Phippard, several from midrange.com, and David Morris.  (Several others
as well, which I recognized as folks who are members of the list whose
names escape me).  SOBIG.F will grab address from your address book and
use them to perpetuate itself. 

It would be statistically very unlikely to get a SOBIG.F e-mail from a
list member as a random occurance (no one on the list infected).  It is
highly improbable to get three without some other relationship, i.e.
list membership.  Assuming the chance of a getting an email from a list
member not through the mail list is a random event (1 in whatever the
total population of the Internet that in infected) to get three randomly
from the same "logical source" is way beyond the
expected distribution (better than 8 sigma).    

My email was worded specifically not to point blame but to raise
awareness.  Actually, I assumed you were *not* infected.  Given that,
the most logical reasoning was that someone else who has both your email
address and mine in their address book *is* infected.  The only place
where that condition could be met was on this mail list. Particularly,
my work email address.  Since I didn't get any SOBIG.F at my home
address, I could narrow the field to professional contacts only (that
and it came to my professional address).  

No worries, mate... this one was bad and the sooner we detect it, the
sooner we can kill it....

thanks

dan
 

-----Original Message-----
From: Joe Pluta [mailto:joepluta@xxxxxxxxxxxxxxxxx]
Sent: Wednesday, August 20, 2003 7:09 PM
To: 'Web Enabling the AS400 / iSeries'
Subject: RE: [WEB400] FW: Thank you!


> From: Eyers, Daniel
> 
> Someone one on this list may be affected by the SOBIG.F virus...  I'm 
> getting emails like the one below with folks addresses from this list.

Actually, the problem with this type of virus is that you really can't
tell just from the email who the sender is.  In fact, it's very likely
that the sender is NOT the domina name in the message; it's been
spoofed.  If you check the message headers you'll be able to see the IP
address of the sender.  I assure you it's not me <smile>.

Joe


_______________________________________________
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list To
post a message email: WEB400@xxxxxxxxxxxx To subscribe, unsubscribe, or
change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.
_______________________________________________
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list To
post a message email: WEB400@xxxxxxxxxxxx To subscribe, unsubscribe, or
change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.