March 31, 2004 12:12 PM PST

As spring arrives, virus spreads seeds far and wide

Related Stories

Netsky variants spark search for code

March 12, 2004

Netsky, we hardly knew ye

March 9, 2004
NetSky variants accounted for 60 percent of all viruses reported in March, making it the most prolific worm in the month, according to a report released Wednesday by security software vendor Sophos.

Fifteen versions of NetSky infected computers during March--sometimes two


Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.


different variants appearing in a single day. And on Wednesday, yet another NetSky variant was discovered, NetSky.R, the second variant to appear this week. Antivirus experts attribute the frequency of the NetSky and Bagle viruses to competition between the virus writers.

"The authors of the NetSky and Bagle worms have been battling for virus-writing supremacy in March, with both releasing new variants in a tit-for-tat game of one-upmanship," said Carole Theriault, a Sophos security consultant. "And in their latest message, NetSky said it will continue to release new variants, as long as Bagle does."

In that most recent message, embedded in the virus code of NetSky.R, the authors take a shot at Bagle's creator, noting: "He opens a back door and makes a lot of money...we will release thousands of our Skynet versions, as long as Bagle is there and the people."

Virus writers who open a back door for spam relaying, in essence make money by selling hordes of e-mail addresses to spammers. NetSky claims its purpose is to remove Bagle viruses from computers.

"Big firms only want to make a lot of money. That is what we don't prefer. We want to solve and avoid it," reads a message embedded in NetSky.Q.

But antivirus experts say NetSky nonetheless creates a problem for companies by forcing them to fight off the constant barrage of viruses. Said Theriault: "There is this constant pounding away at computer users."

In Sophos' March tallies, NetSky variants ranked first, second and third. The NetSky.D variant accounted for 30.2 percent of all infections for the month, NetSky.B represented 12.3 percent, and NetSky.C accounted for 11.7 percent.

Theriault noted that in some cases it's easy to churn out a new version of the virus, simply by altering a few lines of code. Still, during the latter half of the month there were several instances when days would go by without a new version of the virus. The frequency, however, has picked up again this week.

1 comment

Join the conversation!
Add your comment
Apphrend this B---
What is being done about catching the virus writers? I thought that we had such good computer forensics that we would have had an arrest by now! More time should be spent on catching the writers instead of "*** for tat"
fuzzyone@network-one.com
Posted by fuzzyone23 (1 comment )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.