• silicon.com
• Technology
• Security

By Dawn Kawamoto, 30 March 2004 09:25

NEWS The severity rating of the latest incarnation of the NetSky worm has been raised by security firm Symantec.

NetSky.Q was upgraded from a level two to level three threat on the security company's five-point rating system. Symantec said it has received 379 reports of the worm since its discovery on Sunday.

"We see quite a few variations of any major threat," said Sharon Rockman, senior director of Symantec Security Response. "But what is unusual about this time is we are having so many level three upgrades with NetSky, MyDoom and Bagle...Usually, there is one [worm] that is very popular and one to three variants."

Two previous NetSky variants received an upgrade to level three for their wide distribution.

NetSky is a mass-mailing worm that uses a bogus sender address and continually changes its subject line and content. An email attachment usually carries an .exe, .pif, .scr or .zip file extension. The worm distributes itself to email addresses in a victim's hard drive and copies itself into shared folders via file-sharing programs.

Unlike its predecessors, NetSky.Q is scheduled to trigger a beeping alarm at 5:11am US time on Tuesday. This will occur only in infected computers that are operating at the time the alarm is set. NetSky.Q is also expected to release a denial-of-service attack between 8 April and 11 April on several websites, including those of eDonkey2000, Kazaa, eMule, Cracks.am and Cracks.st, according to Symantec.

The latest NetSky variant marks the second consecutive time the worm has been upgraded to a level three threat since the original author announced plans in early March to discontinue releasing variants. That announcement, part of NetSky.K, also noted that the worm's source code would be published, making it available for others to use.

Following the NetSky.K announcement, four other versions of NetSky were released, but those never exceeded a level two threat. Antivirus experts speculated that they were written by other authors who may not have had the same widespread distribution system as the original author had.

Security experts say it's difficult to ascertain whether the original author has stepped back into the game or new virus writers have become more proficient in developing a distribution system for their work.

"Once you release the source code, it's hard to tell if it's from a new author or the original writer," Rockman said.

Dawn Kawamoto writes for CNET News.com