- 4chan hell raisers finding fame brings heat?
- The 10 dumbest mistakes network managers make
- NetApp quits bidding war in face of EMC opposition
- CompuServe closes after 30 years
- Google to launch open-source Chrome OS this year
New versions of the Netsky e-mail worm are spreading on the Internet and may be the work of a different author than previous editions of that worm, according to anti-virus software companies.
Netsky.S appeared on Monday and Netsky.T was detected Tuesday. They are the 19th and 20th editions of an e-mail virus that first appeared in February. Unlike earlier variants, the new Netsky strains open "back doors" on machines they infect, prompting at least one anti-virus expert to declare the worm the work of a different virus author.
Network Associates' McAfee Antivirus Emergency Response Team (AVERT) rated Netsky.S a "medium" threat. The company has received around 300 samples from customers and from virus-infected machines, said Craig Schmugar, virus research manager for McAfee AVERT.
The company has received only a few copies of the Netsky.T virus, he said. Sophos PLC said it received just one copy of the Netsky.T worm, according to an advisory.
Like its predecessors, the new Netsky variants target machines running versions of Microsoft's Windows operating system. The viruses arrive as files enclosed in e-mail messages that have faked (or "spoofed") sender addresses and vague subjects such as "Re: My details," "Request" and "Thank You!" according to anti-virus company Symantec.
Earlier versions of the Netsky variant abstained from opening communications ports that could be used as so-called "back doors" that remote attackers could use to access the compromised system. They removed copies of the Bagle e-mail worm from infected machines.
Some anti-virus experts believe that Netsky's attack on Bagle installations is behind a war of words between the Netsky author or authors and the creators of the Bagle virus family in recent weeks. The two groups have used new worm variants as vehicles for barbs and retorts to previous insults.
In those exchanges, Netsky's author or authors positioned themselves as the "good guys" locked in a battle with online criminals and spammers. One recent variant, Netsky.Q, even contained an impassioned defense of the Netsky worms.
"We don't have any criminal inspirations. Due to many reports, we do not have any backdoors included for spam relaying," read text hidden in Netsky.Q and transcribed by Sophos and other anti-virus companies.
The Leader in Network Knowledge
Comment