Menu
Experts warn of new Netsky worm variant

Experts warn of new Netsky worm variant

Antivirus software companies are warning that a new version of the NetSky email worm is circulating on the Internet, only a day after the appearance of a new variant of the Beagle or Bagle worm prompted similar warnings.

NetSky.B, also known as Moodown.B, first appeared on Wednesday and is spreading through infected email messages and shared network folders.

Once installed, NetSky tries to disable antivirus software, steal email addresses and copy itself to shared network folders, antivirus companies said.

The new worm is a modified version of NetSky.A, which appeared on Monday. Like its predecessor, NetSky.B arrives in email messages that have randomly generated subject lines such as "something for you", "hello" or "fake". The worm file is contained in a zipped attachment that also has a randomly generated name and file type such as "document", "stuff" or "party".

File attachments with an .exe, .scr or .pif extension were also common, antivirus company, TruSecure, said.

Network Associates (NAI) is receiving between 40 and 50 copies of the worm each hour, both from customers and worm-generated email, according to a company spokesperson.

Most copies of the worm appeared to be coming from the Netherlands and elsewhere in Europe, NAI, TruSecure and others said.

Antivirus companies released updated virus definition files to spot the new version of NetSky and advised customers to update their antivirus software as soon as possible.

The new worm outbreak follows a similar infestation on Tuesday, when a new version of the Beagle (or "Bagle") worm surfaced and began spreading rapidly.

The sudden appearance of virus-laden email messages may be evidence of a virus spreading, or of a massive "seeding" of a new virus using spam email messages, antivirus experts said.

A similar seeding was behind the sudden appearance of NetSky.A on Monday, antivirus company, F-Secure, said.


Follow Us

Join the newsletter!

Error: Please check your email address.
Show Comments