Sober

"Byrne, David" <[email protected]> Fri, 6 Jan 2006 07:18:49 -0700
Newsgroups gmane.comp.security.virus
Message-ID <1BAAFB74C5643343B75CF51A121690FB01257E1D@MER2-EXCHA1.echostar.com>
This bounced from the list last night, but it is still accurate.

Some of the URLs that Sober is supposed to check on 01/06/06 (which 
started 45 minutes ago in London) are redirecting to a virus writer's 
web page. One example is http://people.freenet.de/lhxrdryo/, which uses 
JavaScript to redirect to http://spth.host.sk/main.htm. It doesn't 
appear to belong to Sober's author, but if the URL is in control of the 
virus-writing community, something could still happen. Anyone have more 
info?


David Byrne