New Netsky Keeps Up The Trash Talk

Netsky.r, a close variant of the Netsky.q worm first found on Monday, arrives as an e-mail message with the heading "Document %number%," where %number% is a random number.

If the attached .pif file is opened, the worm infects the machine, hijacks e-mail addresses from local address books to propagate, trash a variety of competing worms if found on the system -- including MyDoom.a, MyDoom.b, and multiple versions of Bagle, and during the days of April 12 through 16, conducts denial-of-service (DoS) attacks a number of peer-to-peer software Web sites.

Like Netsky.q, the newest variant targets file-sharing sites such as kazaa.com and emule-project.net.

Deep inside the worm's code, said several anti-virus firms, is text that takes Bagle to task yet again. According to analysis done by both Panda Software and Sophos, the Netsky.r text reads like a semi-smutty sonnet or low-grade hacker rap:

"Yes, true, you have understand it.Bagle is a s***** guy, he opens a backdoor and he makes a lot of money. Netsky not, Netsky is Skynet, a good software, Good guys behind it. Believe me, or not. We will release thousands of our Skynet versions, as long as bagle is there and the people..."

Most security firms rated Netsky.r as a relatively low risk. Symantec, for instance, ranked the new worm as a "2" in its 1 through 5 scale, while Panda Software tagged it as a "Moderate" threat.

*This story courtesy of Techweb.com.