New variant adds to Netsky damage

By Matt Whipp

Posted on 2 Mar 2004 at 15:20

The sky's the limit for Netsky D with nearly 40,000 infected mails intercepted so far, according to MessageLabs.

The UK security company pinpoints the first identification of the worm just before 10am yesterday morning, originating from France. And if your computer began emitting beeping sounds this morning, the chances are, you've got it too.

mi2g's Intelligence Unit said its preliminary data shows NetSky.d to have already caused $58.5 million in estimated economic damage worldwide.

Yet hardly have you updated your antivirus software to protect against NetSky-D when the E variant is jumping up and down for your attention. Again it is a mass mailing worm that attempts to delete antivirus software activities and other infections. However Sophos says it has not received reports of any infections from the public domain.

It appears that virus writers are finding this Internet isn't big enough for all their creations. NetSky D too seeks out and removes evidence of MyDoom infections. It also edits out Registry keys used by two Bagle variants. Likewise, NetSky-C also rids computers it infects of MyDoom and previous incarnations of the NetSky virus.

'It appears that the NetSky.d author was actively coding over the weekend with a view to ensure Bagle malware variants do not take advantage of NetSky zombie computers. This turf war is a new phase in malware evolution,' said DK Matai, Executive Chairman, mi2g.

This new trend gives credence to the suspicions of many antivirus companies that spammers are taking advantage of the virus writing community to create an army of zombie computers to send out spam for them. And with a financial incentive, virus writers are becoming ever more protective over their commandeered troops.

NetSky-B was the second most reported infection in February according to Kaspersky. Trend Micro placed it third - MyDoom ranked top in both charts.