New Bagle released but Netsky tops the malware charts

New Bagle released but Netsky tops the malware charts

Summary: The latest Bagle variant has been relatively active but it has a long way to go before knocking the various Netsky variants out of the virus top 10

SHARE:
TOPICS: Security
0

The 30th variant of mass mailing worm Bagle was discovered on Thursday, which makes it one of the most persistent worms ever discovered, but in terms of infection rates, archrival Netsky is ahead by a long way, according to Finnish antivirus firm F-Secure.

Sven Jaschan, who has admitted writing Netsky and Sasser, was arrested more than two months ago, and although the variants dried up shortly after he was taken into custody, his creations are still disrupting the lives of millions of Internet users.

In a scan of virus threats by F-Secure on Friday, the company found that variants of Netsky accounted for eight of the top 10 places and 71.2 percent of all infections. Zafi.b accounted for 12 percent while Bagle.z was only responsible for 3.3 percent of infections.

Natasha Staley, information security analyst at email security firm MessageLabs, said that although Netsky is far more widespread than the others, it is because there has been a lack of extremely dangerous worms -- such as MyDoom and Sobig.f -- to knock it off the top spot.

"The last major outbreak was from MyDoom in January. But when I say major, I mean 1.2 million copies of the worm in its first 24 hours. We haven't seen anything on that scale since," said Staley.

According to Messagelabs's statistics, the latest Bagle worm only managed a few thousand copies in its first day. Staley said this is not because Bagle is bad at replication, but because anti virus companies are familiar with the worm's source code and can spot it very easily.

"Bagle's code is pretty well known now so it isn't too difficult for software products to detect it," said Staley.

Worryingly, Staley said that because there hasn't been another MyDoom-type attack in more than six months, there is likely to be one in the near future -- and this will knock Netsky out of the top 10.

"Six months has passed and although you can't predict this scientifically, I wouldn't be surprised if there was another major outbreak fairly soon," said Staley.

Topic: Security

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

0 comments
Log in or register to start the discussion