Sober.X Virus

[erikhertzel]

Hello,

I was just curious as if other people are seeing and getting this virus as much as I see it hitting out mail server. It seems like we are getting more of this virus than any other previous virus in quite a while.

We are stopping it just fine and it's not infecting our network, it's just a hassle more than anything.

Thanks for the info.

 

[greyted]

erichertzel;

Have a here:

http://secunia.com/virus_information/23836/sober.x/

For the Secunia rating and various vendor reports.





Men occasionally stumble over the truth, but most of them pick themselves up and hurry off as if nothing ever happened.

Sir Winston Churchill

 

[PeterHurst]

Absolutely bombed with it yes, our AV hardware blocks it before the SMTP gateway wo the problem is not the load more the hung connections

 

[cmeagan656]

We use a Fortinet Fortigate-60 for our firewall. Its got built-in antivirus (which we use) and spam filter (which we don't use as XWall is better). The Fortigate-60 is antivirus is stopping the virus in its tracks. We've had no hung connections, delayed delivery of email due to exccessive traffic on our Exchange server, or anything and we're being slammed with it.

 

[goldenboiyaj]

W32.Sober.X@mm!zip

i'm completely swamp with this virus. keeps appearing on my email network server. my A/V detects it, and deletes it, but it keeps appearing over and over again and A/V keeps Deleting. doesnt seem like it is. any help?



any idea? I have Symantec Enterprise 10 with the latest definition too.

thanks

 

[cmeagan656]

At one point yesterday we were averaging 60 - 80 hits per hour. If you don't have a way to stop it before it hits your mail server (i.e. spam filter or firewall) I don't think there's much you can do.

I've never used Symantec so I don't know how that works.

Cheers.

 

[jpm121]

goldenboy, it sounds like your AV is doing what it's supposed to do -- deleting the virus each time it comes in on an e-mail! Or are you seeing something different?

If someone out there is hammering you with the virus then those attempts are being blocked, right?