On Sep 8, 2004, at 12:16, Timo Schöler wrote:
Doug Hardie wrote:
I have a cron job that scans the clamd.log file every day and counts the specific virusus found. While the numbers tend to vary a bit from day to day the relative ratios between the various viruses found tend to stay the same - except for Worm.Zafi.B. One day it will find 1100 of them and the next day 8. It is never consistent. I am not seeing any significant number of viruses slipping through. It seems to be some sort of distribution issue with that virus itself. The others all seemed to come on strong at first and then die down to residual annoyances. But not this one. It keeps coming back in volume periodically. Any ideas what makes this one so different from the rest?
perhaps this may be interesting stuff for you:
http://www.cs.berkeley.edu/~nweaver/sapphire/
Thanks but I would expect from that that the worm activity would tend to die down to a relatively constant nuisance level. However, its not doing that every couple days I get another flood of them.
there may be several reasons:
i) changing network behaviour (route flaps, etc.)
ii) changing effectiveness of virus filters et al.
iii) built-in automatisms in worm/virus itself
NB: it is not always best to spread a virus/worm at the highest available speed (depends on number of infected hosts, bandwidth available to the hosts, etc.).
i'm sure i missed another point i didn't think of now ;)
-- mit vorzueglichster Hochachtung/best regards,
Timo Schoeler
//macfinity -- finest IT services | Triftstrasse 39 | 13353 Berlin | Germany
Fon ++49 30 25 20 30 20 | Fax ++49 30 25 20 30 19
PGP data http://www.macfinity.net/~tis/contact/PGPPKB_timo.schoeler.txt
------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_idP47&alloc_id808&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
