Re: acl to combat Sober-Z or Sober.X

[Peter Smith <peter.smith@xxxxxxxxxxxxxxxxxx>]

I don't know if I read the Symantec data correctly as it was a tiny bit 
ambiguous, but it is possible that only the 5 domains listed are needed, 
rather than any pseudo-specific URLs..

Peter

Peter Smith wrote:

> My attempt at potentially controlling Sober-Z or Sober.X on my network 
> (based off of the Symantec data [1] ):
>
> squid.conf:
> acl virus url_regex -i "/etc/squid/virus"
> http_access deny virus
>
> /etc/squid/virus:
> http://home.pages.at/Gruppfelhuber(/.*)?$
> http://people.freenet.de(/.*)?$
> http://scifi.pages.at(/.*)?$
> http://home.pages.at(/.*)?$
> http://free.pages.at(/.*)?$
> http://home.arcor.de(/.*)?$
> http://free.pages.at/jexsxjpsccpjz(/.*)?$
> http://home.arcor.de/sjgdqverwom(/.*)?$
> http://home.arcor.de/chjzfoay(/.*)?$
> http://home.arcor.de/gtvqgphqsgpjk(/.*)?$
> http://home.arcor.de/waxshhzsdwsz(/.*)?$
> http://home.arcor.de/zhowmxwozay(/.*)?$
> http://people.freenet.de/mookflolfctm(/.*)?$
> http://people.freenet.de/aohobygi(/.*)?$
> http://people.freenet.de/wlpgskmv(/.*)?$
> http://people.freenet.de/svclxatmlhavj(/.*)?$
> http://people.freenet.de/jpjpoptwql(/.*)?$
> http://people.freenet.de/iohgdhkzfhdzo(/.*)?$
> http://people.freenet.de/eetbuviaebe(/.*)?$
> http://scifi.pages.at/vvvjkhmbgnbbw(/.*)?$
> http://home.pages.at/twfofrfzlugq(/.*)?$
> http://free.pages.at/sfhfksjzsfu(/.*)?$
> http://home.arcor.de/qlqqlbojvii(/.*)?$
> http://home.arcor.de/fulmxct(/.*)?$
> http://home.arcor.de/fowclxccdxn(/.*)?$
> http://home.arcor.de/lnzzlnbk(/.*)?$
> http://home.arcor.de/rprpgbnrppb(/.*)?$
> http://people.freenet.de/iufilfwulmfi(/.*)?$
> http://people.freenet.de/xbqyosoe(/.*)?$
> http://people.freenet.de/nkxlvcob(/.*)?$
> http://people.freenet.de/svclxatmlhavj(/.*)?$
> http://people.freenet.de/bnymomspyo(/.*)?$
> http://people.freenet.de/jbevgezfmegwy(/.*)?$
> http://people.freenet.de/gdvsotuqwsg(/.*)?$
> http://scifi.pages.at/eveocczmthmmq(/.*)?$
> http://home.pages.at/doarauzeraqf(/.*)?$
> http://free.pages.at/hsdszhmoshh(/.*)?$
> http://home.arcor.de/dyddznydqir(/.*)?$
> http://home.arcor.de/iyxegtd(/.*)?$
> http://home.arcor.de/oakmanympnw(/.*)?$
> http://home.arcor.de/riggiymd(/.*)?$
> http://home.arcor.de/jhjhgquqssq(/.*)?$
> http://people.freenet.de/zmnjgmomgbdz(/.*)?$
> http://people.freenet.de/smtmeihf(/.*)?$
> http://people.freenet.de/qisezhin(/.*)?$
> http://people.freenet.de/fseqepagqfphv(/.*)?$
> http://people.freenet.de/urfiqileuq(/.*)?$
> http://people.freenet.de/wjpropqmlpohj(/.*)?$
> http://people.freenet.de/mclvompycem(/.*)?$
> http://scifi.pages.at/zzzvmkituktgr(/.*)?$
> http://home.pages.at/npgwtjgxwthx(/.*)?$
> http://free.pages.at/emcndvwoemn(/.*)?$
> http://home.arcor.de/ocllceclbhs(/.*)?$
> http://home.arcor.de/dixqshv(/.*)?$
> <snip>