Virus
Virus

Virus war of words falls silent

Netsky and Bagel variants continue to spring up, but virus writers' slanging match cools down

Iain Thomson

New versions of the Netsky and Bagel worms have emerged in the wild, but neither infection seeks to rekindle the public spat that broke out last week between the rival virus authors.

Security experts reported that both the Netsky J and Bagel K mutant worms were spreading, but that the virus writers' slanging match appears to have ended.

Advertisement

The latest Bagel variant uses new social engineering techniques to persuade readers to open the password-protected zip file attachment.

The message warns that complaints have been made against the recipient for improper email use.

Carole Theriault, security consultant at Sophos said: "There is no progress in the war of words.

"There are still messages in Bagel K but they haven't changed which indicates they were just left in when this variant was created. The message is a nasty tactic as well; making people paranoid is never pleasant."

The virus generates a message claiming that a user's email account has been temporarily disabled because of 'unauthorised access' and urges them to open the attachment in order to reactivate the account.

The full body copy of the virus-generated email also attempts to make its recipient open the attachment by claiming that it will remove viruses that are present on the user's PC.

With the usual disregard for spelling and grammar, the virus text claims: "Your e-mail account has been temporary disabled because of unauthorized access.

"Our antivirus software has detected a large ammount of viruses outgoing from your email account, you may use our free anti-virus tool to clean up your computer software."

Once activated the worm collects email addresses and mails itself onwards using its own SMTP engine. It also listens at port 2745 and can download files remotely.

Bagel K is currently spreading more slowly than the other new variant Netsky J.

"The new Netsky is a medium range threat and we are not expecting it to blow up," said David Emm, product marketing manager at McAfee Security.

"This is a repackaged Netsky D: very similar but with a different 32-bit compression packer to get it past filters. We are not seeing any more messages but that does not mean it's all over."

The latest Netsky variant comes as an attachment to an email with a number of social engineering headers. After being executed, it harvests email addresses and mails itself out as a .pif attachment.

The worm also attempts to shut down any antivirus software in operation on the PC, and removes any Bagel worm infestation.

  • Have your say
  • Send to a friend
  • Print
  • Digg
  • Reddit
  • Share

Tags:

Do you agree?

Further reading

Security

Security

The latest wave of cyber-crimes and acts of vandalism have demonstrated once again that many systems are still vulnerable to attack.

Netsky dominates March virus attacks

'Torrent' of Netsky and Bagle variants released in war of the worm writers

Bugwatch: The virus avalanche

Take cover - here comes another MyDoom/Netsky/Bagle variant ...

New worm masquerades as Microsoft update

Sober variant employs latest social engineering technique

Related whitepapers

Related jobs

Most watched

eu flag

V3.co.uk weekly debrief, 6 Nov 09

This week, Europe decides what to do with illegal file sharers

Intel unveils its micro server platform

Small-enclosure systems take aim at hosting market

IT white papers

Search white papers

Top categories

Poll

Impact of Information Overload poll

Impact of Information Overload poll

What is the biggest problem your firm faces as a result of the data explosion?

View poll results

Advertisement

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Spotlight

eu flag

V3.co.uk weekly debrief, 6 Nov 09

This week, Europe decides what to do with illegal file...

Dell Adamo XPS

Dell launches ultra-thin Adamo XPS

World's thinnest laptop will be available by Christmas

Top 10 articles, 6 November 2009

The worst Microsoft products of all time, and a USB...

Iain Thomson

Pirate Bay shutdown could be inspiring online militancy

Recent Swedish attacks raise worrying possibility

Primary Navigation