[61940] in North American Network Operators' Group
Re: SoBig volume way down
daemon@ATHENA.MIT.EDU (Joe Boyce)
Wed Sep 10 14:22:34 2003
Date: Wed, 10 Sep 2003 11:21:41 -0700
From: Joe Boyce <jboyce@shasta.com>
To: nanog@merit.edu
In-Reply-To: <Pine.BSF.4.44.0309101358410.69885-100000@richard2.pil.net>
Errors-To: owner-nanog-outgoing@merit.edu
From what I understood, it was supposed to (or did) deactivate on
9/10/03.
Regards,
Joe Boyce
---
InterStar, Inc. - Shasta.com Internet
Phone: +1 (530) 224-6866 x105
Email: jboyce@shasta.com
Wednesday, September 10, 2003, 11:03:03 AM, you wrote:
u3a> the volume of SoBig virii hitting our mail server had gotten so big that I
u3a> had to have a cron job delete the quarantine every hour. We were
u3a> averaging about 400 of them per hour until around midnight last night,
u3a> where the volume went to and remains about 1/10th of that. Did this thing
u3a> expire (in which case, roughly 10% of all infected machines have
u3a> misconfigured clocks, assuming the exp date was in UDT), or did something
u3a> else happen? Just curious...
u3a> James Smallacombe PlantageNet, Inc. CEO and Janitor
u3a> up@3.am http://3.am
u3a> =========================================================================
