NetSky tops virus chart

The Netsky worm took the first, second and third spots in antivirus company Sophos' ranking for March.

The NetSky worm took the first, second and third spots in antivirus company Sophos' ranking for March.

Different versions of the NetSky worm accounted for almost 60% of all the virus submissions to Sophos.

NetSky.D, which appeared on 1 March, was the most reported virus and was responsible for 30% of the virus reports.

A version of the Bagle virus, Bagle.C, took fourth place in the monthly ranking. Different versions of Bagle or NetSky tied up the top nine spots on the listing of the top 10 viruses.

MyDoom.A, the original version of that worm, came in at number 10.

A war of words between the authors of the Bagle and NetSky worm was the likely motivation for many of the worm variants released in March, Sophos said.

Messages buried in different variants of the two worms have carried insults and taunts back and forth for weeks.

Recently, NetSky's author or authors have even used embedded messages to claim the moral high ground. For example, the recently released NetSky.R variant contains a message from the authors saying that the Bagle worm was bad for opening a so-called "backdoor" on infected machines, while NetSky is "good software" with "good guys behind it", and does not do so, according to a Sophos transcription of the message.

Sophos recommended that customers block any e-mail messages containing programs before they reach users' in-boxes and configure their anti-virus products to update their virus signatures automatically.

Like most anti-virus companies, Sophos collects samples of suspected viruses submitted by customers and other internet users. It uses virus samples to develop "signatures" that can identify and thwart infection by new species of viruses and worms.

Paul Roberts writes for IDG News Service

Read more on Antivirus, firewall and IDS products