Technorati
Digg
Delicious
Reddit
StumbleUpon
Facebook
Yahoo
Twitter
Faves
Newsvine
- Discovered:
- February 1, 2010
- Updated:
- February 1, 2010 1:29:52 PM
- Also Known As:
- WORM_NETSKY.A [Trend], Worm:W32/Netsky [F-Secure]
- Type:
- Worm
- Infection Length:
- 21,504
- Systems Affected:
- Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
W32.Netsky@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. This worm also searches drives C through Z for the folder names containing "Share" or "Sharing," and then copies itself to those folders.
The "From" and attachment names of the email vary.
Note: Misleading Applications, also known as Rogue Security Software, are fake antivirus programs that display fake virus infection alerts in order to trick users into downloading or paying for the application. Two commonly reported fake infections are “Worm.Win32.Netsky” and “Win32.Netsky.Q”.
While similar to the name of the threat in this writeup, these fake detections are not related, and running the removal tool will report that no instances of the threat were found on your computer. For more information about Misleading Applications, see the recent Symantec Report on Rogue Security Software.
The "From" and attachment names of the email vary.
Note: Misleading Applications, also known as Rogue Security Software, are fake antivirus programs that display fake virus infection alerts in order to trick users into downloading or paying for the application. Two commonly reported fake infections are “Worm.Win32.Netsky” and “Win32.Netsky.Q”.
While similar to the name of the threat in this writeup, these fake detections are not related, and running the removal tool will report that no instances of the threat were found on your computer. For more information about Misleading Applications, see the recent Symantec Report on Rogue Security Software.
Antivirus Protection Dates
- Initial Rapid Release version February 16, 2004
- Latest Rapid Release version May 14, 2012 revision 038
- Initial Daily Certified version February 16, 2004
- Latest Daily Certified version May 15, 2012 revision 004
- Initial Weekly Certified release date February 16, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
- Wild Level: Low
- Number of Infections: 0 - 49
- Number of Sites: 0 - 2
- Geographical Distribution: Low
- Threat Containment: Easy
- Removal: Moderate
Damage
- Damage Level: Low
- Large Scale E-mailing: Uses its own SMTP engine to send itself to the email addresses it retrieves from the files whose extension is one of the following: .adb, .asp, .dbx, .doc, .eml, .htm, .html, .msg, .oft, .php, .pl, .rtf, .sht, .tbb, .txt, .uin, .vbs, and .wab.
Distribution
- Distribution Level: Medium
- Subject of Email: Auction successful!
- Name of Attachment: prod_info_55761.rtf.exe.zip prod_info_65642.rtf.scr.zip prod_info_33543.rtf.scr.zip prod_info_564
- Size of Attachment: 21,504
- Target of Infection: Searches all the folders whose names contain "Share" or "Sharing" on drives C to Z, and then copies itself to the folder, if the drive is not the CD-ROM drive.
Writeup By: Yana Liu
