Stig Arne Bye wrote:

noah wrote:

snip

After the infected attachment has been removed by Norton AntiVirus (TM),
the remainder (the mail header) is moved to a spesial file. By using
these headers, I can then make a graphic chart (by using a small program
I have made myself) showing how many infected e-mail that has been
received each day, as you can from the following:

E-mail infected by W32.Swen.A@mm (Worm.Automat.AHB)
================================================== =

Total count: 2337

YYYY.MM.DD 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
---------- ----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
2003.09.19 #########| | | | | | | | | |
2003.09.20 ############################################### | | | | | |
2003.09.21 #######################################| | | | | | |
2003.09.22 ################################## | | | | | | |
2003.09.23 ############################################## | | | | | |
2003.09.24 ######################### | | | | | | | |
2003.09.25 ################# | | | | | | | | |
2003.09.26 ###### | | | | | | | | | |
2003.09.27 #########| | | | | | | | | |
2003.09.28 * ####### | | | | | | | | | |
----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000

* Not accomplished (count updated as per 28.09.2003 at 13:58).


After this, I encountered an increase in infected e-mail received, where
the number of infected e-mail received each day were stable around 150
per day for several days. However, now it finally seem to be a
noticeable decrease as you can see from the last graph generated below
(in fact, I haven't received ANY e-mail infected with the Swen.A worm
for the last about 6 hours).


E-mail infected by W32.Swen.A@mm (Worm.Automat.AHB)
================================================== =

Total count: 3072

YYYY.MM.DD 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000
---------- ----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
2003.09.19 #########| | | | | | | | | |
2003.09.20 ############################################### | | | | | |
2003.09.21 #######################################| | | | | | |
2003.09.22 ################################## | | | | | | |
2003.09.23 ############################################## | | | | | |
2003.09.24 ######################### | | | | | | | |
2003.09.25 ################# | | | | | | | | |
2003.09.26 ###### | | | | | | | | | |
2003.09.27 #########| | | | | | | | | |
2003.09.28 ########## | | | | | | | | |
2003.09.29 ################# | | | | | | | | |
2003.09.30 ################ | | | | | | | | |
2003.10.01 ################ | | | | | | | | |
2003.10.02 ############## | | | | | | | | |
2003.10.03 #########| | | | | | | | | |
2003.10.04 * | | | | | | | | | |
----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|----|
50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 800 850 900 950 1000

* Not accomplished (count updated as per 04.10.2003 at 01:26).


BTW, I noticed that the previous mass mailing worm (Sobig.F) was first
discovered on 18th of August, and this last mass mailing worm (Swen.A)
was first discovered on 18th of September.
If the identical dates is an actual pattern, then just wait until
18th of October.....



Stig Arne Bye

E-mail ......:
Contact .....: AOL IM: VT480TFE / MSN: / ICQ: 403349
Snail-Mail ..: P.O.Box 169, NO-9915 Kirkenes, Norway
Homepage ....: http://home.online.no/~stigbye/index.html
------------------------------------------------------------------------
Located just about 70°N 30°E - Almost at the top of the world!