F-secure list of sober virus urls



When the news was first out that an antivirus firm (f-secure) had cracked the psuedo-random algorithm that the sober worm uses to determine where to download “updates” from, they said that they had previously notified German authorities where the free hosting sites were located so that they could deal with the sites. I did find that they have announced a list of the addresses for the January 5th update (and the January 6th as well.)


Great to see this information released. They’ve left out the filename, but I’ll reproduce the list here…

http://people.freenet.de/gixcihnm/
http://people.freenet.de/tobtrfjabzw/
http://people.freenet.de/utzmfucaau/
http://people.freenet.de/phyibrpkcpl/
http://people.freenet.de/lhxrdryo/
http://people.freenet.de/yediykdq/
http://people.freenet.de/bjjhdkybpyaj/
http://scifi.pages.at/agzytvfbybn/
http://home.pages.at/bdalczxpctcb/
http://free.pages.at/ftvuefbumebug/
http://home.arcor.de/ijdsqkkxuwp/
http://home.arcor.de/ldhdytdu/
http://home.arcor.de/wdqodvdhwwese/
http://home.arcor.de/frweemrecuvw/

http://home.arcor.de/nulmjznomnt/

The above addresses are due to be used for the January 5th download, the following list will be those used on January 6th…

http://people.freenet.de/mookflolfctm/
http://people.freenet.de/aohobygi/
http://people.freenet.de/wlpgskmv/
http://people.freenet.de/svclxatmlhavj/
http://people.freenet.de/jpjpoptwql/
http://people.freenet.de/iohgdhkzfhdzo/
http://people.freenet.de/eetbuviaebe/
http://scifi.pages.at/vvvjkhmbgnbbw/
http://home.pages.at/twfofrfzlugq/
http://free.pages.at/sfhfksjzsfu/
http://home.arcor.de/qlqqlbojvii/
http://home.arcor.de/fulmxct/
http://home.arcor.de/fowclxccdxn/
http://home.arcor.de/lnzzlnbk/

http://home.arcor.de/rprpgbnrppb/

After that the list is expected to change every 14 days. The virus syncs the systems time so that it does know the correct date and time. (NTP? via the atomic clocks?)

So, if your a system administrator and can block urls on your network – this might be a good batch to add to your list.

Related Posts

Blog Traffic Exchange Related Posts
  • New variation of Sober virus coming in January Now, we seem to be getting "coming attractions" previews in virus-land.... Anyway, I've read at several sources that we are to expect a new variation on the sober worm around January 5th, 2006. It's said that the date was chosen to mark the formation of the Nazi Party. In the......
  • Another Sober.y reminder f-secure.com has another warning for us about the pending awakening of the sober worm. From reports it's expected to start looking for sites to download from January 5th into January 6th. There is an extensive list of URL's to block. This from f-secure.com - if you're in charge of block......
  • How to Remove Windows Smart Security (Removal Guide) Windows Smart Security is a rogue spyware application that may fool people into installing and purchasing due to the use of the words Windows and Security in the title. It may fool people into thinking that it is related to Microsoft Windows and perhaps even a part of the operating......
Blog Traffic Exchange Related Websites
  • Using Social Bookmarking To Promote Your Online Business Social bookmarking websites have been used for several years for finding and driving high quality traffic to business websites. It's a simple idea, marketers post quality content designed to help people, and a common result is that exchange will produce quality traffic to your site. As you can guess, since......
  • Using a Home Improvement Video to Guide Your Project Home improvement handymen these days get a lot of their information from the internet. There is nothing wrong with this as there are many sites just like this one that exists to provide people with useful information on the different aspects of home improvement. However, one thing that you need......
  • Fancy Love by Jessica Simpson for Women, 3.4 oz Eau De Parfum Spray User Reviews Send this to a friend Fancy Love by Jessica Simpson for Women, 3.4 oz Eau De Parfum Spray Manufacturer: Customer Rating: List Price: Varies based on product options Sale Price: View Sale Price Availibility: View Product Availability Buy Now Product Description Product Details No details are available......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site