On Fri, Dec 03, 2004 at 02:54:44PM -0800, Todd Lyons wrote:
> Jan Pieter Cornet wanted us to know:
> >What I find really odd is your complete lack of Worm.Sober-I. Our stats for
> >Thu Dec 2:
>
> Good point. I had totally missed that too.
>
> >Top-5:
> >W32/Sober-I : 1078544
> >W32/Netsky-P : 57920
>
> That's a pretty big difference, seems more like an internal infection
Erm... I cheat bit, because I'm counting recipients, not emails.
Sober-I sends to multiple recipients. We "only" had 178405 viruses
that day (about 2 per second). Still makes it to the #1 position, though.
Viruses come in from 2212 different IP addresses, from all over the
world... but the top-10 /8s are all from the RIPE region.. first non-RIPE
is 66.0.0.0/8 with 66 different IPs (66x66/8. Coincidence? I think not! :)
Yep, it might be regional indeed. Odd.
--
#!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]>
$p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+
$_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9,
3,1)]),5,1)='`'lt$&;$f.eig; # Jan-Pieter Cornet
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
