Random thought... the website Sobig.F hits could have been hacked by the author. I'd bet it is the counter for the virus' infection rate. Maybe the author has gained access to the website statistics, and is using it to track the virus' progress. Then the repeated Friday/Sunday polls could be the author's way of following infection. Wild guess, but I would think that if it was malicious, the author is waiting for a critical mass of dot-F to be dormant, to be ready for dot-G.