Three education portals remain the focus of the latest Netsky variant, which targets the sites for a distributed denial-of-service attack in early May. Antivirus experts are baffled as to why the three sites, located in Florida, Switzerland and Germany are the target of the worm writer.