New Virus W32/Netsky.b@MM

krazy1 · Feb 18, 2004, 04:26 PM

Watch your e-mail boxes for another new Virus on the loose. Spreading fast. Symantec

Here is the info I got from an alert center. More here then what Symantec has so far..... (Sorry in Adv for the length)

Aliases:
W32/Netsky-B, W32/Netsky.b@MM, WORM_NETSKY.B, I-Worm.Moodown.B

Description of Incident

A new mass-mailing worm has appeared in moderate-large numbers. It copies
itself as a either a zip archive or an executable file. When as a zip the
user has to unzip and run the executable.

Subject: Randonly chosen from:

unknown
fake
stolen
information
warning
something for you
read it immediately
hello

Message body: Randonly chosen from:

something is fool
something is going wrong
you are bad
you try to steal
you feel the same
you earn money
thats wrong
why?
take it easy
reply
do you?
that's funny
here, the cheats
here, the introduction
here, the serials
from the chatter
about me
information about you
something is going wrong!
stuff about you?
greetings
see you
here it is
that is bad
yes, really?
i found this document about you
your name is wrong
i hope it is not true!
kill the writer of this document!
something about you!
I have your password!
you are a bad writer
is that from you?
i wait for a reply!
is that your account?
is that your name?
is that true?
here
my hero
read it immediately!
here is the document.
read the details.
i'm waiting
what does it mean?
anything ok?

Attachment: One of the following file names with a double extension

misc
party
disco
part2
mail2
object
ranking
dinner
release
final
location
jokes
friend
website
mails
story
found
nomoney
aboutyou
shower
topseller
product
swimmingpool
bill
note
concert
textfile
posting
stuff
attachment
details
creditcard
message
talk
document
unknown
fake
stolen
information
warning
something for you
read it immediately
hello

First extions are:
.txt
.rtf
.doc
.htm

For the second extension the worm uses the following:

.exe
.scr
.com

Severity: Medium
Incidence: Medium
Potential impact: High

Dyre Straits · Feb 18, 2004, 04:48 PM

Thanks for the heads up.

It's been posted on the Front Page and is now in the News Archives.

GutterPunk · Feb 18, 2004, 05:57 PM

thanx for the info good work

Feb 18, 2004, 04:26 PM	#1
krazy1 Live from the Dungeon Join Date: May 2003 Location: Between the SubWoofers Posts: 1,395 Rep Power: 0	New Virus W32/Netsky.b@MM Watch your e-mail boxes for another new Virus on the loose. Spreading fast. Symantec Here is the info I got from an alert center. More here then what Symantec has so far..... (Sorry in Adv for the length) Aliases: W32/Netsky-B, W32/Netsky.b@MM, WORM_NETSKY.B, I-Worm.Moodown.B Description of Incident A new mass-mailing worm has appeared in moderate-large numbers. It copies itself as a either a zip archive or an executable file. When as a zip the user has to unzip and run the executable. Subject: Randonly chosen from: unknown fake stolen information warning something for you read it immediately hello Message body: Randonly chosen from: something is fool something is going wrong you are bad you try to steal you feel the same you earn money thats wrong why? take it easy reply do you? that's funny here, the cheats here, the introduction here, the serials from the chatter about me information about you something is going wrong! stuff about you? greetings see you here it is that is bad yes, really? i found this document about you your name is wrong i hope it is not true! kill the writer of this document! something about you! I have your password! you are a bad writer is that from you? i wait for a reply! is that your account? is that your name? is that true? here my hero read it immediately! here is the document. read the details. i'm waiting what does it mean? anything ok? Attachment: One of the following file names with a double extension misc party disco part2 mail2 object ranking dinner release final location jokes friend website mails story found nomoney aboutyou shower topseller product swimmingpool bill note concert textfile posting stuff attachment details creditcard message talk document unknown fake stolen information warning something for you read it immediately hello First extions are: .txt .rtf .doc .htm For the second extension the worm uses the following: .exe .scr .com Severity: Medium Incidence: Medium Potential impact: High __________________

Feb 18, 2004, 05:57 PM	#3
GutterPunk I = Greatest Dood Join Date: Nov 2003 Location: Nebraska Posts: 5,949 Rep Power: 70	thanx for the info good work __________________ Rock On \m/ Thank you Mousey for the Sig! --------------- Intel Core2Duo E6660 (3.4GHZ) ~ Tuniq Tower 120 ~ Enermax Galaxy 1000W ~ Corsair Dominator @ 1090MHZ 5-5-5-15 (OCZ XTC Modded Cooler)~ EVGA 8800GTX W/ HR-03 Plus 120MM ~ Asus DVD-RW LiteScribe ~ LG DVD-RW ~ Corsair Voyager 2GB ReadyBoost Drive ~ Vantec Nexus Fan Controller ~ ThermalTake Armor 25CM fan ~ Personal Finance Blog: Dent Your Debt