Re: W32/Sobig-F - Halflife correlation ???

2003-08-26 Thread Darren Smith
Did anyone else see anything with regards to this thread? Regards Darren Smith - Original Message - From: "Darren Smith" <[EMAIL PROTECTED]> To: "Robert Blayzor" <[EMAIL PROTECTED]>; "North American Network Operators Group" <[EMAIL PROTEC

Re: W32/Sobig-F - Halflife correlation ???

2003-08-23 Thread Darren Smith
most of them were on 27015, these logs were from just one of my transit interfaces. Best Regards Darren Smith - Original Message - From: "Robert Blayzor" <[EMAIL PROTECTED]> To: "North American Network Operators Group" <[EMAIL PROTECTED]> Sent: Saturday, Aug

Re: W32/Sobig-F - Halflife correlation ???

2003-08-23 Thread Darren Smith
were getting traffic from those 20 boxes (blocked with an ACL) - i'll have to check through my netflow logs for more details. Also, "Stephen J. Wilcox" saw traffic destined for his CS Servers. They were trying to hit servers in multiple subnets, all on ports 270XX. Best Regards Darre