14 Months worth of stats...

[Frank S]

Just thought some would be interested in my stats over the last 14 months
using Trend Micro's OfficeScan product. These stats are the total hits for
6 machines combined, connected to the Internet, running a firewall and
internet gateway using NAT (three servers and three workstations). My
systems are all W2K. They run an ftp server, web server, telnet server, and
Terminal Server (application server). All are accessable from the web. To
my knowledge, I have not had a single infection over these 14 months. (yeah,
I know, "to my knowledge")

Considering the regency of SOBIG and SWEN (last month or so?), it's amazing
how high a percentage they consume over a 14 month period.

Not to say this would apply to all, but maybe interesting from a one system
perspective anyway.

Virus Name -- Total Hits -- Percent of total
-------------------------------------------------------------
WORM_SOBIG.F -- 195 -- 56.5%
WORM_SWEN.A -- 117 -- 33.9%
JS_EXCEPTION.GEN -- 16 -- 4.6%
WORM_KLEZ.H -- 5 -- 1.4%
JAVA_BYTVERIFY.A -- 2 -- 0.6%
WORM_BRAID.A -- 2 -- 0.6%
WORM_Sobig.E -- 2 -- 0.6%
HTML_IFRMEXP.GEN -- 1 -- 0.3%
PE_BRID.A -- 1 -- 0.3%
TROJ_SMALL.J -- 1 -- 0.3%
Others -- 3 -- 0.9%

 

[GSV Three Minds in a Can]

Just thought some would be interested in my stats over the last 14 months
using Trend Micro's OfficeScan product. These stats are the total hits for
6 machines combined, connected to the Internet, running a firewall and
internet gateway using NAT (three servers and three workstations). My
systems are all W2K. They run an ftp server, web server, telnet server, and
Terminal Server (application server). All are accessable from the web. To
my knowledge, I have not had a single infection over these 14 months. (yeah,
I know, "to my knowledge")

Considering the regency of SOBIG and SWEN (last month or so?), it's amazing
how high a percentage they consume over a 14 month period.

Swen is only about 8 or 9 days, and yeah it's truly amazing how well it
spread, given that most of the methods it uses have been tried before,
and should have been blocked by now.