The Netsky worm swept the competition for “top virus” in March, taking the first, second and third spots in antivirus company Sophos PLC’s ranking for the month.
Different versions of the Netsky worm accounted for almost 60 percent of all the virus submissions to Sophos. Netsky.D, which appeared on March 1, was the most-reported virus and was responsible for 30 per cent of the virus reports, Sophos said.
A version of the Bagle virus, Bagle.C, took fourth place in the monthly ranking. Different versions of Bagle or Netsky tied up the top nine spots on the listing of the top 10 viruses.
The only virus not from either the Bagle or Netsky line to make it on the list for March was MyDoom.A, the original version of that worm, which came in at number 10, accounting for less than one per cent of submissions.
A war of words between the authors of the Bagle and Netsky worm was the likely motivation for many of the worm variants released in March, Sophos said.
Messages buried in different variants of the two worms have carried insults and taunts back and forth for weeks. Recently, Netsky’s author or authors have even used embedded messages to claim the moral high ground. For example, the recently released Netsky.R variant contains a message from the authors saying that the Bagle worm was bad for opening a so-called “backdoor” on infected machines, while Netsky is “good software” with “good guys behind it,” and does not do so, according to a Sophos transcription of the message.
Sophos recommended that customers block any e-mail messages containing programs before they reach users’ inboxes and configure their antivirus products to update their virus signatures automatically.
Like most antivirus companies, Sophos collects samples of suspected viruses submitted by customers and other Internet users. It uses virus samples to develop “signatures” that can identify and thwart infection by new species of viruses and worms.