[67016] in North American Network Operators' Group
MyDoom statistics (was Re: Impending (mydoom) DOS attack)
daemon@ATHENA.MIT.EDU (Sean Donelan)
Fri Jan 30 20:27:09 2004
Date: Fri, 30 Jan 2004 20:26:34 -0500 (EST)
From: Sean Donelan <sean@donelan.com>
To: Mike Tancsa <mike@sentex.net>
Cc: nanog@merit.edu
In-Reply-To: <6.0.1.1.0.20040130195346.08e4a370@209.112.4.2>
Errors-To: owner-nanog-outgoing@merit.edu
On Fri, 30 Jan 2004, Mike Tancsa wrote:
> Are there any reliable estimates as to the amount of infected hosts out
> there? Looking at my stats for email sent this week, I am seeing a 70:1
> ratio for mydoom.a as compared to Swen.a (the next most prevalent virus).
> Perhaps if we had some rough #s to work with we could start to approximate
> the range of traffic volumes we might see.
Reliable? Not really.
McAfee's global virus statistics say 17% of all scanned computers were
infected by W32/Mydoom.a.
But I don't believe that number, because it is wildly different than
other metrics. A lot of users have experienced the MyDoom file being
on their computer (e.g. through a mail message). But I don't think
that represents the number of people which clicked and executed
the file, infecting their computer.
