Virus writer resorts to poetry

The author of the latest variant of the Bagle worm has gone beyond penning just a piece of code: The writer has also included a poem in the document attachment on which the worm piggybacks. The malicious program, known as Bagle.Z, has not spread very quickly, said Vincent Gullotto, vice-president of the antivirus emergency response team for Network Associates, which makes security software. "I don't anticipate this one to last long," he said, adding that the variant has had some initial success because the worm attaches itself to e-mail in a control panel file, which is an executable not used by virus writers before. "It is not a file that most people would typically block, so it may penetrate into some environments."

The release of Bagle.Z is the latest in what appears to be a contest between the writers of two worms: Bagle and NetSky. A recent version of NetSky, or SkyNet, as the author calls it, included a promise by the writer to keep creating new versions as long as the creator of the Bagle worm keeps revising that program.

While there were at least six different versions of NetSky released in April, far fewer Bagle variants have been seen this month. Virus experts believe that the source code to the NetSky worm was leaked to the Internet by the author, and so it is likely that no single author created all the variants.

Read Full Story