We have a little less volume than you do, but it's amazing how concentrated the messages can be. My personal account which has many domains pointed at it has not received a single copy of the virus, but one account on our server has been hit over 500 times in the last 48 hours. We run Declude Virus, but it's only available to about half of the accounts, JunkMail though has caught everything that gets there.
FWIW, we see the most hits on E-mail addresses that appear on web sites. It seems that is the primary source of E-mail addresses for Sobig. It also explains why msnbc.com's mailservers were down for about 12 hours yesterday (tons of people go there, and have E-mail addresses in their caches).
And, Sobig.F seems to send out many copies of itself to the same addresses (I'm sure there are people that are smart enough not to open that "wicked cool screensaver" the first 20 times, but figure it must be safe the 21st time...). We've seen 100s or 1000s of copies sent from one computer to one E-mail address.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
