Half of Australian virus infections attributed to Netsky - News - Security

To print: Select File and then Print from your browser's menu

--------------------------------------------------------------
This story was printed from ZDNet Australia.
--------------------------------------------------------------

Half of Australian virus infections attributed to Netsky

By Munir Kotadia, ZDNet Australia
February 02, 2005
URL: http://www.zdnet.com.au/news/security/soa/Half-of-Australian-virus-infections-attributed-to-Netsky/0,130061744,139179558,00.htm

Variants of the Netsky worm account for almost half of all malware infections in Australia, according to Trend Micro's January 2005 Virus Roundup.

Netsky, which has not triggered a major virus alert since the middle of last year, is a mass mailing worm that uses clever social engineering techniques to fool users into opening its attachments. The worm can also take advantage of an old vulnerability in Microsoft's Internet Explorer browser.

Mark Sinclair, technical services manager at Trend Micro Australia and New Zealand, said that although January 2005 was relatively peaceful in terms of virus infections, the company still recorded 2,236 malware programs, which is a 500 percent increase when compared to January last year. Despite this massive increase, he said Netsky was still causing the most problems.

"Netsky still dominates Australian infections for January 2005. The key to its success is its use of social engineering techniques, which lowers the user's vigilance. Netsky.P chooses from hundreds of possible subject lines and message bodies while also falsely stating that the e-mail has been scanned by antivirus software," said Sinclair.

Additionally, Sinclair said that Netsky is difficult to guard against on unpatched PC.

"Netsky.P possesses one attribute that makes it difficult to guard against - it exploits an IE vulnerability (MS01-020) that was announced three years ago, which allows the automatic execution of e-mail attachments when an email message is read or even just previewed," he said.

Sean Richmond, senior technical consultant at Sophos in Australia and New Zealand, which also released its virus report for January, said he was disappointed that the majority of malware infections over the past month could be dealt with using up to date security software.

"It is disappointing to note that January's top-ten entries have all been stoppable for at least six weeks. While most of the entries are more than six months old they are still polluting the email streams of thousands of internet users," said Richmond.

Richmond said that one in every 23 e-mails circulating in January contained a virus, so users should consider making another new year's resolution.

"Something along the lines of 'I will not double-click on random executable attachments'," said Richmond.