Netsky Hacker Threatens Thursday Attack

A message embedded within one of the most recent Netsky worm variants may spell trouble on Thursday, according to analysis done by an anti-virus firm.

Text tucked inside the Netsky.k worm, which first appeared Monday, indicates a possible attack on Thursday, March 11, said Panda Software in an advisory.

"The 11th of march is the skynet day," said the text in part, giving Panda researchers reason to believe that the Netsky author plans another wave of attacks. The creator of Netsky has repeatedly referred to himself as "Skynet" or "Skynet AntiVirus."

Some variants of the Netsky worm have taken on other malicious code, including MyDoom and Bagle, to seek out and eradicate them from systems it finds infected. The Netsky vs. Bagle/MyDoom battle escalated last week with a tit-for-tat exchange of crude messages buried within the worms' code.

In Netsky.k, the hacker went on to take MyDoom's and Bagle's creators to task. "When the beagle and mydoom loose [lose], we wanna stop our activity. thats now. And personal words to mydoom: Your are so [obscenity omitted] i never seen in my life."Another interpretation of some of the message within Netsky.k, however, could lead to the conclusion that the war between worm writers is coming to a close.

"This is the last version of our antivirus," the author claimed near the end of the embedded message. "The source code is available soon."

On Wednesday, however, yet another Netsky variation, dubbed Netsky.l, was uncovered by several anti-virus firms, including Sophos.

"This time there are no comments to Bagle and MyDoom so hopefully the war is over," said Sophos in a statement posted on its Web site.