Sobig.F...what took so long

["Robert Ahnemann" <rahnemann () affinity-mortgage com>]

So its 4 days after the virus was found, and they just discover that its
got a list of 20 machines that it will pull from to create a massive
DDoS across the net?  What took them so long to find it?