[PLUG] The big virus in the news

[Paul Heinlein]

On Thu, 21 Aug 2003, AthlonRob wrote:

> It seems more prolific than anything else I've seen lately.  Maybe
> I'm just in more address books now - I dunno.

There are plenty of decent scientific analyses of Sobig-F on the net,
and they're better sources of real data that I am. Still, I have some
anecdotal[1] evidence from work that suggests that it's a particularly
prolific little bugger. Here's a list of the top five viruses we've
intercepted at our mail gateway so far in the third quarter of 2003:

  11580 W32/Sobig-F
    509 W32/Sobig-E
    506 W32/Mimail-A
    182 W32/Klez-H
     19 W32/Bugbear-B

Percentage-wise, Sobig-F is off the charts, outrunning its nearest
rival by well over 2000% -- and it's not done yet. By Sept. 10, when
Sobig-F is supposedly set to turn itself off, I expect we'll have
intercepted over 25,000 copies of this thing. No other worm/virus
comes close.

Until Sobig-G, of course, which will likely be even "better" than its
-F-in' cousin.

--Paul Heinlein <heinlein at madboa.com>

[1] As someone once posted to PLUG: The plural of 'anecdote' is not
    'data.'