Patrick Lee
Over the years, virus authors have sought to convey messages in their creations. Quite frequently, these are not normally displayed, the virus code must be examined to find them. This year, the authors of Bagle, Mydoom and Netsky have traded insulting comments in this way. In April, although both the author(s) of Bagle and Mydoom viruses have stopped appending text strings inside their executables in April, the author(s) of the Netsky variants still have something to say. Here is a chronological list of the nature of the messages:
- 31st March 2004: W32/Netsky.R thanks "Mr. Bruce Schneider" (sic); we have no idea why. 6th April 2004: W32/Netsky.T said it has backdoors but not for spam relaying. This time it thanks Russia and CCC.
- 17th April 2004: It seems that W32/Netsky.W is not created by the original writer(s), as it thanks Skynet or Netsky or whatever crew for the source code.
- 20th April 2004 W32/Netsky.Y greets the Bagle worm.
- 28th April 2004 The 27th variant of Netsky, W32/Netsky.AA "avenges" Bagle.
The Bagle and Mydoom authors have ignored Netsky’s threat and continue their mischief. These are intriguing glimpses into the mind of the authors, but are they just put there to mislead us?