F-secure list of sober virus urls



When the news was first out that an antivirus firm (f-secure) had cracked the psuedo-random algorithm that the sober worm uses to determine where to download “updates” from, they said that they had previously notified German authorities where the free hosting sites were located so that they could deal with the sites. I did find that they have announced a list of the addresses for the January 5th update (and the January 6th as well.)


Great to see this information released. They’ve left out the filename, but I’ll reproduce the list here…

http://people.freenet.de/gixcihnm/
http://people.freenet.de/tobtrfjabzw/
http://people.freenet.de/utzmfucaau/
http://people.freenet.de/phyibrpkcpl/
http://people.freenet.de/lhxrdryo/
http://people.freenet.de/yediykdq/
http://people.freenet.de/bjjhdkybpyaj/
http://scifi.pages.at/agzytvfbybn/
http://home.pages.at/bdalczxpctcb/
http://free.pages.at/ftvuefbumebug/
http://home.arcor.de/ijdsqkkxuwp/
http://home.arcor.de/ldhdytdu/
http://home.arcor.de/wdqodvdhwwese/
http://home.arcor.de/frweemrecuvw/

http://home.arcor.de/nulmjznomnt/

The above addresses are due to be used for the January 5th download, the following list will be those used on January 6th…

http://people.freenet.de/mookflolfctm/
http://people.freenet.de/aohobygi/
http://people.freenet.de/wlpgskmv/
http://people.freenet.de/svclxatmlhavj/
http://people.freenet.de/jpjpoptwql/
http://people.freenet.de/iohgdhkzfhdzo/
http://people.freenet.de/eetbuviaebe/
http://scifi.pages.at/vvvjkhmbgnbbw/
http://home.pages.at/twfofrfzlugq/
http://free.pages.at/sfhfksjzsfu/
http://home.arcor.de/qlqqlbojvii/
http://home.arcor.de/fulmxct/
http://home.arcor.de/fowclxccdxn/
http://home.arcor.de/lnzzlnbk/

http://home.arcor.de/rprpgbnrppb/

After that the list is expected to change every 14 days. The virus syncs the systems time so that it does know the correct date and time. (NTP? via the atomic clocks?)

So, if your a system administrator and can block urls on your network – this might be a good batch to add to your list.

Related Posts

Blog Traffic Exchange Related Posts
  • How to Remove Windows Smart Security (Removal Guide) Windows Smart Security is a rogue spyware application that may fool people into installing and purchasing due to the use of the words Windows and Security in the title. It may fool people into thinking that it is related to Microsoft Windows and perhaps even a part of the operating......
  • How to Remove Anti-Virus Elite | Anti-Virus Elite Removal Guide Anti-Virus Elite is a rogue antivirus application. These rogue antivirus applications pose as a legitimate security application, but in reality is a scam to try to trick you out of money. They will find and claim that there are multiple security problems with your computer. They will claim that you......
  • Major botnet building and the massive jump in spam For a few months now (since the demise of bluefrog actually) I've noticed that the level of junk mail has gone up on my own mail server. Yes, I use spamassassin to filter and tag, but the volume of stuff that's tagged has gone up (as well as the volume......
Blog Traffic Exchange Related Websites
  • What Is Seo: Myth Or Reality? Some Thoughts On Search Engine Optimization What is SEO? Have you ever though about what you are trying to achieve with search engine optimization, and what you were doing with your website to achieve it? Have you never wondered if there were better ways to get to where you want to be as a result of......
  • Using Social Bookmarking To Promote Your Online Business Social bookmarking websites have been used for several years for finding and driving high quality traffic to business websites. It's a simple idea, marketers post quality content designed to help people, and a common result is that exchange will produce quality traffic to your site. As you can guess, since......
  • Fancy Love by Jessica Simpson for Women, 3.4 oz Eau De Parfum Spray User Reviews Send this to a friend Fancy Love by Jessica Simpson for Women, 3.4 oz Eau De Parfum Spray Manufacturer: Customer Rating: List Price: Varies based on product options Sale Price: View Sale Price Availibility: View Product Availability Buy Now Product Description Product Details No details are available......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site