On Mon, Sep 15, 2003 at 09:06:44AM -0700, Steve Thomas wrote: > On Sat, Sep 13, 2003 at 06:57:27PM +0200, Kristian Koehntopp is rumored to have said: > > On Fri, Sep 12, 2003 at 04:34:40PM -0700, Abigail Marshall wrote: > > > 2. SobigF expired on September 10th. There may be a few > > > errant worms floating around from computers that have their > > > dates wrong, but you probably won't see many. > > > > You won't see any. Earlier version of Sobig did use local > > clocks, but at least the E and F strains have been using NTP to > > get their time off the network to avoid precisely this problem. > > Are you sure about that? I've still been getting a few here and there. I > had two copies come into my personal server just last night and over 100 > on our mail server at work over the weekend.
Based on the information from http://www.lurhq.com/sobig-e.html, fairly sure (they claim that all Sobig from Sobig.C on used NTP). Also, I am not getting any any more, according to my stat generators. Kristian ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
