Dr Web's estimate of Flashback infections

Source: Dr Web Initial reports of drops in the number of systems infected with the Flashback Mac malware are being corrected – the adjusted number is now back to around 550,000 systems. The corrections come after it was shown by Dr Web that one system among the various command and control IP addresses was halting bot scans. Flashback-infected machines randomly work through a generated range of different systems, connecting to each to check for commands. The blocking system meant that companies, like Dr Web, who set up their sinkhole servers earlier, so that they could estimate the number of infections, got to see more infected machines connecting, while sinkholes set up later saw fewer infected systems. Read more...