The Sobig.F e-mail virus continued its rampage across the Internet Thursday, forcing budget-stressed state agencies to spend hours clearing clogged computer systems.

The fastest-growing e-mail virus ever attacked every state agency and department across California, swamping computers with hundreds of thousands of infected e-mails, said Kevin Terpstra, spokesman for Gov. Gray Davis' information technology office. One agency reported receiving a bad e-mail every three minutes.

"There is a barrage of it. It's like being in the jungle and trying to ward off mosquitoes," Terpstra said. Despite the attacks, the state computer systems remained up.

Fighting the bug, however, will come at a cost to cash-strapped California. Terpstra said the agencies are still tallying up the overtime costs.

At the University of California, Berkeley, workers have had to put in extra hours this week as well.

"A lot of university business is done by e-mail. People's e-mail was greatly delayed," said Cliff Frost, chief of the university's computer systems. "A lot of people were staying up late (Wednesday)."

He estimated the campus -- with 45,000 computers -- was hit by about 400,000 infected e-mails this week.

Happily, one expert said Thursday that the worst may be over.

"It has hit its peak and will trail off slowly," said Jimmy Kuo, who founded the anti-virus team at the McAfee division of Network Associates Inc. The onslaught should ease up this weekend and then spike again Monday.

If that's the case, small businesses and consumers will be particularly relieved. Many had their e-mail backed up beyond all recovery.

The Los Angeles Times reported that a Southern California law firm was effectively shut down after its network clogged from a Sobig infection Tuesday evening, before word of the dangerous messages spread.

"They were an early adopter," Afinety Inc. Vice President Kevin J. McCarthy said dryly after his company was called in to disinfect the lawyers' machines. He declined to identify the client.

Over the past five days, the virus, or worm, has sent itself millions of times over as an attachment to e-mails with subject lines such as "Details," "Wicked screensaver," and "That movie." Once the attachment is opened, the worm replicates the e-mail and every 10 minutes, sends it off to other users from the infected computer's address book. The worm does not delete files from the computer, but turns it into a spamming machine, slowing down systems and networks. Some e-mail providers catch them, and some don't.

America Online on Thursday matched Wednesday's record, when 23 million copies of the virus were blocked before they reached AOL users' e-mail boxes, spokesman Nicholas Graham said.

In spreading through attachments, Sobig is similar to earlier viruses, like Melissa and ILove-You. But the Los Angeles Times reported that unlike its predecessors, Sobig has become more sophisticated in successive versions since its discovery in January. It is one of the first to install a "back door" for additional manipulation by hackers.

"Traditionally, viruses only propagated copies of themselves," John R. Levine, author of "Internet for Dummies" and a computer language consultant, told the Times. "It's a fairly recent development -- over the past few months -- that we're seeing viruses that leave a trap door so bad guys can come in later and install more hostile software."

Not all large firms were well-protected against Sobig. Several companies were struggling to contain the effects of earlier viruses and worms.

CSX Corp., the railroad giant, said that the Blaster worm infected its signaling and dispatching systems early Wednesday morning. All service was halted for two pre-dawn hours, and morning commuter service in Washington, D.C., was canceled.

CSX spokesman Adam Hollingsworth said Thursday night that freight customers were still experiencing delays. "We're having to use manual processes instead of automated ones," he said.

Air Canada was also hit this week with a virus, which forced agents to check in clients manually.

Computer users should not open attachments from suspect e-mail. Kuo, of Network Associates, said major anti-virus vendors are offering free online scanning for consumers who suspect their computers have been infected by the virus.

He said the virus is programmed to deactivate itself on Sept. 10.