New breeds of Netsky worms emerge
The latest versions of the Netsky e-mail worm spreading on the internet may be the work of a different author, antivirus software companies believe.
Netsky.S appeared on Monday and Netsky.T was detected the following day. They are the 19th and 20th editions of an e-mail virus that first appeared in February.
Unlike earlier variants, the latest strains open "back doors" on machines they infect, prompting at least one antivirus expert to declare the worm the work of a different virus author.
Network Associates' McAfee Antivirus Emergency Response Team (Avert) rated Netsky.S a "medium" threat. The company has received around 300 samples from customers and from virus-infected machines, said Avert virus research manager Craig Schmugar, adding that company has received only a few copies of Netsky.T.
Sophos said it received just one copy of Netsky.T.
Like its predecessors, the variants target machines running versions of Microsoft Windows. The viruses arrive as files enclosed in e-mail messages that have faked or "spoofed" sender addresses and vague subjects such as "Re: My details", "Request" and "Thank You!" according to antivirus company Symantec.
Earlier versions of the Netsky variant abstained from opening communications ports that could be used as so-called "back doors" that remote attackers could use to access the compromised system. They removed copies of the Bagle e-mail worm from infected machines.
