Follow-up to my previous blog posting on the high rate of Blackworm infections, Gadi Evron at Securiteam updates us with (relatively) good news:
After investigation with the ISP and various people from our task force (special thanks to Joe Stewart and all the SANS ISC handlers) it appears that someone (probably the worm author) was trying to be funny and DDoS the counter.
Looking only at unique IP addresses and removing the ones from the DDoS, we end up with only about 300K users whose world is going to crumble on February 3rd.
Good. Because I just checked the counter and it’s up to over 3 million.
Still, as Gadi points out, there’s an estimate of possibly 300,000 users who are going to have a potentially serious data loss on the 3rd.
Alex Eckelberry