A war of insults between worm writers has caused virus alerts to rise by more than 600 per cent.
Anti-virus firm Trend Micro issued a total of 232 virus warnings in the first quarter of 2004, which is 6.6 times more than the 35 issued in Q1 2003. The company issued 11 medium-to-high level virus alerts, 119 low alerts, and 112 general alerts. The alerts included warnings on MyDoom, NetSky and Bagle.
While creating the worms, authors published a series of insults criticising each of the other’s work, enticing others to go one better than the previous worm.
“Summer was the peak season for viruses, but this has been moved up to the first quarter this year,” said Ang Ah Sin, regional marketing manager for South Asia at Trend Micro. “These huge numbers not only cause one to worry about the network security environment for the rest of 2004, but also highlight the importance of a proactive security system.”
One virus writer claimed that NetSky was a plagiarised version of MyDoom. Code contained in NetSky.F mocked the Bagle worm writer saying, “Bagle – you are a loser!.”
The Bagle author’s reply, “Don’t ruin our business, wanna start a war?” has raised concern that Bagle will continue its battle against Netsky into Q2.
Virus writers made four variants of the Netsky worm, which held first, third, fourth and fifth places in the top ten viruses in March.
The worm infected more than half a million machines in March.
Many of the viruses were disguised as compressed ZIP files, which can easily slip by anti-virus detectors. The technique allowed malware to hide from corporate gateways and antivirus software, increasing their infection rate.