Following on from threats made last week by the authors of the worms Bagle and Netsky, the war of the worms has escalated to a new level.
A message found in Netsky.K, which was first detected this Monday, contained additional threats towards the other virus authors. "We want to destroy malware writers business, including Mydoom & Bagle", the message said.
The message further stated that Netsky was not intended to do any harm, but to do good. The message states "F-Secure [an anti-virus company] and so on, we do not want to damage systems, we only want to avoid that bagle continues his dirty business".
It also indicates that this was to be the final version of Netsky. "When... bagle and Mydoom [fail], we wanna stop our activity..." the message says. At another point it also says "This is the last version of our anti-virus".
However, while this implies the Netsky author does not intend to publish any more variants, the message also suggests the source code will be released, "The source code is available soon".
With the source code, other virus authors could potentially create their own variations of Netsky. In fact, this may have already occurred. Netsky.K was first detected Monday, and on Wednesday another variant, Netsky.L, was identified by anti-virus companies. This new worm did not contain any messages to other virus authors, indicating it may have originated from a different author to the original Netsky.
The message in Netsky.K also suggests there will be some kind of virus attack today, "the 11th of March is the skynet day". It is not clear what the author means by this, but some anti-virus companies are preparing for the worst.
Panda Software states on its website, "According to the message, the creator or creators of the Netsky worms could be preparing some kind of attack on 11 March, which could see the appearance of an even more virulent variant or the emergence of several new variants at the same time."
Due to the unknown nature of the threat, and the fact other similar threats have been issued by virus authors in the past, there is also the possibility there will be no significant attack on this date. "Of course, there is every possibility that the message is simply an empty threat," states the Panda Software release.
Panda has advised users to keep their anti-virus software up to date, and to exercise extra caution when opening emails today.