 (8.9.1/8.9.1) with ESMTP id QAA02813	for ; Mon, 11 Aug 2003 16:28:30 -0700 (PDT) Received: (from lap@localhost)	by charm.physics.ucsb.edu (8.9.3/8.9.3) id QAA22296	for lap@neutrino.physics.ucsb.edu; Mon, 11 Aug 2003 16:28:30 -0700 Received: from ucsb.edu (hub.ucsb.edu [128.111.24.40])	by charm.physics.ucsb.edu (8.9.3/8.9.3) with ESMTP id QAA22293	for ; Mon, 11 Aug 2003 16:28:30 -0700 Received: from localhost ([127.0.0.1] helo=hub.ucsb.edu)	by ucsb.edu with esmtp  id 19mM5W-000MzN-0Z; Mon, 11 Aug 2003 16:28:30 -0700 Received: from hub.ucsb.edu ([128.111.24.40] helo=smtp.ucsb.edu)	by ucsb.edu with esmtp TLSv1:AES256-SHA:256 id 19mM5T-000MzC-3h;	Mon, 11 Aug 2003 16:28:27 -0700 Received: from security3.oit.ucsb.edu ([128.111.12.28])	19mM5S-000Mz8-Vf; Mon, 11 Aug 2003 16:28:26 -0700 Date: Mon, 11 Aug 2003 16:28:25 -0700 From: E. Todd Atkins  To: security-announce@ucsb.edu Message-ID: <188650000.1060644505@abc.oit.ucsb.edu> X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline cc: csf@ucsb.edu Subject: [CSF] W32/Blaster Infected Hosts Being Null-Routed X-BeenThere: csf@ucsb.edu X-Mailman-Version: 2.1.1 Precedence: list Reply-To: UCSB Network Security Coordinator  List-Id: Computer Support Forum  List-Unsubscribe: ,	 List-Archive:  List-Post:  List-Help:  List-Subscribe: ,	 Sender: csf-bounces@ucsb.edu Errors-To: csf-bounces@ucsb.edu X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *19mM5W-000MzN-0Z*m.2IzBFn1DE* Good Afternoon, Due to the large number of hosts that are infected with the W32/Blaster  worm, I am sending out this bulk announcement about hosts whose traffic is  being blocked with a null route in order to suppress our involvement in the  spreading of this worm. Here is what you need to do if your host is in the list: 	1. Perform a complete reinstallation and patching of the system. 	2. Send an email message to security@ucsb.edu to inform us that 	   the host is now safe to be connected with the internet. When 	   referring to multiple IP addresses, please list the IP addresses 	   on separate lines. Here is the list of infected hosts: 128.111.62.229 128.111.62.234 128.111.62.239 128.111.68.35 128.111.69.48 128.111.77.83 128.111.83.202 128.111.83.55 128.111.94.30 128.111.104.81 128.111.106.197 128.111.108.193 128.111.112.12 128.111.112.39 128.111.112.41 128.111.112.79 128.111.112.87 128.111.113.121 128.111.113.145 128.111.113.147 128.111.113.152 128.111.113.16 128.111.113.200 128.111.113.21 128.111.113.218 128.111.113.222 128.111.113.24 128.111.113.40 128.111.113.63 128.111.113.72 128.111.113.92 128.111.122.18 128.111.130.27 128.111.130.28 128.111.133.114 128.111.138.169 128.111.162.4 128.111.164.52 128.111.164.81 128.111.165.63 128.111.165.88 128.111.185.106 128.111.185.19 128.111.185.205 128.111.185.244 128.111.199.50 128.111.205.148 128.111.205.16 128.111.208.178 128.111.208.68 128.111.209.116 128.111.209.140 128.111.209.89 128.111.209.92 128.111.220.143 128.111.220.162 128.111.220.57 128.111.220.90 128.111.223.26 128.111.226.213 128.111.226.98 128.111.227.150 128.111.227.22 128.111.227.90 128.111.229.251 128.111.241.70 128.111.241.74 Also, results of the Symantec analysis are being made available to the  public at the following location: https://tms.symantec.com/members/AnalystReports/030811-Alert-DCOMworm.pdf It is expected that this report will be updated frequently as more information is discovered.  Readers are advised to download/refresh it throughout the day to ensure that any new information is not missed. Thank you and good luck, Todd Atkins Network Security Coordinator UCSB/Office of Information Technology Voice: (805) 893-5077 Fax: (805) 893-5051 http://www.oit.ucsb.edu/security _______________________________________________ CSF mailing list  -  CSF@ucsb.edu http://ucsb.edu/mailman/listinfo/csf