It's a new month with a new Internet worm - actually a new version of an old pest.

Netsky-D began spreading, taking advantage of computers not yet protected with updated programs or anti-virus shields and tricking users into opening attachments with subject lines like "re: details" or "re: here is the document."

You can't rely on the sender, either, since some copies are "spoofing" addresses. One appears to come from e-Bay, another from Microsoft.

It also uses a .pif (program information file) extension rather than the more common .exe or .scr used by most infections. Many users are unfamiliar with the .pif extension and thus may not be as cautious.

Several new versions also appeared of another old pest, Bagle or Bagel. Two versions - F and G - use a password-protected ZIP file to sneak past anti-virus scanners. But the virus authors have to give the password in the body of a message and this complexity makes it harder to spread.

None of the Bagles does much except harvest addresses to send out new copies of the infection

Source:  Secure Agent E-newsletter, Volume 188 - March 8,2004