SoBig tutorial needed

[joyride]

Howdy ppl...does anyone know how the SoBig virus replicates and works in detail. I think that would be helpful in designing a measure to stop or to reduce the threat that the Sobig.G virus is expected to inflict. I really dont stand for the filter approch in which you filter all the executable files or for filtering unknown users.

[IFixDaWindoze]

What is wrong with filtering emails with executable attachments? With the exception of a very few tech support people sending me patches/fixes/updates I never get legit emails with executables. I don't really see how knowing the details of how it spreads will help you to block it.

[mohaughn]

Any of the big AV vendors has full information online about this and any other virii out there.

[NeuTron]

Originally posted here by IFixDaWindoze
What is wrong with filtering emails with executable attachments? With the exception of a very few tech support people sending me patches/fixes/updates I never get legit emails with executables. I don't really see how knowing the details of how it spreads will help you to block it.

You actually don't see how knowing the way a virus spreads can help you to combat it? How the hell would you learn to block something without knowing it's method of infection or mobility?

joyride- Here is the page that Symantec posted about the virus and it's method of infection.
http://securityresponse.symantec.com...obig.f@mm.html

[spools.exe]

I say if your gonna send an exe zip it up, that way exe files can be blocked and when a person download a zip file they can scann it first brfore opening it. Thats what were trying to do ay my workplace, a local ISP.

[groovicus]

Or another method I find quite useful would be to rename it to SoBig.ded... accidents do happen