Like Ben and J. Lo, the SoBig.F virus long ago overstayed its welcome and seems to be intent on hanging around to annoy as many people as possible. But, unlike Bennifer, the virus mercifully is set to expire on Wednesday, providing worm-weary administrators and users with a bit of relief.
The original SoBig virus appeared in early January, welcoming workers back from the holidays with a raft of infected messages from big@boss.com. In the intervening eight months, five more variants have been set loose, with varying degrees of success.
But none of the previous versions even remotely approached the infection rates that SoBig.F has achieved.
The latest iteration of the virus hit the Internet on Aug. 18 and spawned more than a million copies of itself in the first 24 hours of its existence. At its peak later that week, one in every 17 pieces of e-mail inspected by e-mail security provider MessageLabs Inc. was infected with SoBig.F. Since then, the infection rate has slowed, but MessageLabs continues to stop as many as 600,000 copies of the virus each day.
The respite from SoBig may be short-lived however, as many anti-virus experts expect another variant to be released soon after this one expires. There is some debate in the community on this point, as well as the question of whether all of the previous versions of SoBig have been created by one person. But if history is any guide, it wont be long before another variant is flooding inboxes with maddening levels of junk.
Each version of SoBig has had an expiration date on which the virus is programmed to stop attempting to spread. In some cases, new variants have arrived just before the previous one expired and other times there has been a gap of a week or two between releases.
“I would say that because this one got so much press attention and people are waiting, the author probably will hold fire for a bit,” said Mark Sunner, CTO of MessageLabs, based in New York. “I dont think well actually see one right away because lots of people are now working in unison on this, and people are looking for a new variant.”
However, Sunner believes that the SoBig epidemic will continue for the foreseeable future for one simple reason: it keeps working.
“This will succeed every time. It exploits a weakness in desktop anti-virus, which is reactive by nature,” said Sunner. “Its a sure thing well see another one. The author is obviously pretty savvy technically and will be mindful that people anticipate another one.”