Security news
Security news3 March 2004
Bagle and Netsky battle for supremacy in internet skirmish, Sophos advises
 |
| The Netsky worms are named after the Skynet corporation from the movie The Terminator. |
Anti-virus experts at Sophos have discovered that the creators of the Netsky and Bagle worms, both of which have spread widely across the internet in a number of different guises, are engaged in an internet skirmish.
The author of the Bagle worms has encoded a number of abusive messages inside recent variants of his creation, attacking the Netsky worm's creator.
Meanwhile, the W32/Netsky-F worm is designed to remove infections of the W32/Bagle-A, W32/Bagle-B (also known as W32/Tanx-A), W32/Bagle-C, W32/Bagle-D, W32/Bagle-E, W32/Bagle-F, W32/Bagle-G, W32/Bagle-H, and W32/Bagle-I worms if it finds them whilst spreading. Sophos believes that the author of Bagle is unlikely to be able to resist responding to this assault against his virus.
Many new versions of the two worms have appeared in the last few days, clogging up business email systems as companies attempt to deal with the flood of unwanted messages.
"The two worm authors are goading each other with taunts and malicious code to release more powerful versions of their viruses," said Graham Cluley, senior technology consultant for Sophos. "We believe both authors may have access to an underground network consisting of thousands of compromised computers owned by innocent users, which are being exploited to launch every new version of their worms. All computer users should ensure that their PCs are properly protected with up-to-date anti-virus software and firewall protection; it's not just a good idea for your own personal data's safety, but responsible behaviour for any member of the internet community."
Sophos recommends companies automatically update their corporate virus protection, and filter attachments which may contain malicious code at the email gateway.
Further reading: Simple steps to protect against viruses
