A computer worm designed to undo some of the damage caused by MyDoom continues to spread quickly, experts warned on Thursday.
Netsky.b, first spotted on Wednesday, is a variant of another worm released earlier in the week. Analysis carried out by anti-virus company McAfee shows that the worm can deactivate MyDoom on infected computers by deleting the commands that switch the older virus on each time the machine boots up.
MyDoom was released on 26 January and quickly became the fastest spreading computer bug in history. Although Netsky.b has spread far less quickly, experts predict that it could still result in concentrated pockets of infection.
“Netsky.b is like a cluster bomb,” says Ken Dunham, security analyst for US computer security company iDefense. “It spreads to various networks via e-mail, and then erupts on the network through shared files. Networks infected with this worm will likely experience a dramatic outbreak, while others may not see much of it at all.”
Advertisement
Anti-virus experts also say even altruistic worms can cause major problems. Although Netsky.b does not delete files or cause other damage on an infected computer it could easily clog up a company’s email server.
Read immediately
The worm arrives attached to email and infects a computer when the attachment is opened. Once activated, it forwards itself on to every email address found in the infected machine’s address book. Like MyDoom, the worm only infects computers running Microsoft’s Windows operating system.
Each new copy of Netsky.b may have a different file name designed to trick a recipient into activating it, such as “document”, “creditcard” or “jokes”. The subject line of emails carrying the worm also vary, with versions including “read it immediately!”, “I found this document about you” or “is that your account?”.
The worm also tried to spread itself through file-sharing networks normally used trade to music, video and software. It does this by copying itself to any folders containing the phrase “sharing”, which are created and used by file-sharing programs.
Meanwhile, another worm released this week, Bagle.b, was named the third widest spreading in history. Messagelabs says at the peak of its spread on Tuesday the newer worm accounted for 16 percent of all email messages sent in the US, 13 percent in the UK and 10 percent in Germany. A variant of the original Bagle worm, Bagle.b was first identified on Tuesday.
