Virus
Virus

Virus war of words falls silent

Netsky and Bagel variants continue to spring up, but virus writers' slanging match cools down

Iain Thomson

New versions of the Netsky and Bagel worms have emerged in the wild, but neither infection seeks to rekindle the public spat that broke out last week between the rival virus authors.

Security experts reported that both the Netsky J and Bagel K mutant worms were spreading, but that the virus writers' slanging match appears to have ended.

Advertisement

The latest Bagel variant uses new social engineering techniques to persuade readers to open the password-protected zip file attachment.

The message warns that complaints have been made against the recipient for improper email use.

Carole Theriault, security consultant at Sophos said: "There is no progress in the war of words.

"There are still messages in Bagel K but they haven't changed which indicates they were just left in when this variant was created. The message is a nasty tactic as well; making people paranoid is never pleasant."

The virus generates a message claiming that a user's email account has been temporarily disabled because of 'unauthorised access' and urges them to open the attachment in order to reactivate the account.

The full body copy of the virus-generated email also attempts to make its recipient open the attachment by claiming that it will remove viruses that are present on the user's PC.

With the usual disregard for spelling and grammar, the virus text claims: "Your e-mail account has been temporary disabled because of unauthorized access.

"Our antivirus software has detected a large ammount of viruses outgoing from your email account, you may use our free anti-virus tool to clean up your computer software."

Once activated the worm collects email addresses and mails itself onwards using its own SMTP engine. It also listens at port 2745 and can download files remotely.

Bagel K is currently spreading more slowly than the other new variant Netsky J.

"The new Netsky is a medium range threat and we are not expecting it to blow up," said David Emm, product marketing manager at McAfee Security.

"This is a repackaged Netsky D: very similar but with a different 32-bit compression packer to get it past filters. We are not seeing any more messages but that does not mean it's all over."

The latest Netsky variant comes as an attachment to an email with a number of social engineering headers. After being executed, it harvests email addresses and mails itself out as a .pif attachment.

The worm also attempts to shut down any antivirus software in operation on the PC, and removes any Bagel worm infestation.

  • Have your say
  • Send to a friend
  • Print
  • Digg
  • Reddit
  • Share

Tags:

Do you agree?

Further reading

Security

Security

The latest wave of cyber-crimes and acts of vandalism have demonstrated once again that many systems are still vulnerable to attack.

Netsky dominates March virus attacks

'Torrent' of Netsky and Bagle variants released in war of the worm writers

Bugwatch: The virus avalanche

Take cover - here comes another MyDoom/Netsky/Bagle variant ...

New worm masquerades as Microsoft update

Sober variant employs latest social engineering technique

Related whitepapers

Related jobs

Most watched

HTC Hero

Hands on with the HTC Hero

V3.co.uk gets a walk through of the Hero, which includes HTC's new Sense overlay for Android

Xperia X1

Video Review: Sony Ericsson Xperia X1

First Looks Editor Ian Williams gets hands on with the Sony Ericsson Xperia X1

IT white papers

Search white papers

Top categories

Poll

Poll: Summer smartphones

Poll: Summer smartphones

Which smartphone will you be taking to the beach this summer?

View poll results

Advertisement

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Spotlight

HTC Hero

Hands on with the HTC Hero

V3.co.uk gets a walk through of the Hero, which includes...

NetGear ReadyNAS NVX

Review: NetGear ReadyNAS NVX

NetGear's four-bay compact network-attached storage gets a serious speed boost

AMD

AMD adds to six-core Opteron line up

New HE processors promise even lower power consumption

Adobe Systems

Adobe launches ColdFusion 9 and ColdFusion Builder

Firm promises enhanced developer productivity

Primary Navigation