Looks like Sober.Z is starting up...

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

It's just sending SPAM at this point... But I've only seen packet traces
from two infected hosts.

The first clue was DNS requests for:
arcor.de IN MX
freenet.de IN MX

Then a bunch of SPAM, this started at about 6:40pm PST

my 3

Site Timeline