W32.Netsky.C@mm

W32.Netsky.C is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. This worm also searches drives C through Y for the folder names containing "Shar" and then copies itself to those folders.

The Subject, Body, and email attachment vary.

---

Notes:

• Symantec Consumer products that support Worm Blocking functionality automatically detect this threat as it attempts to spread.
• Rapid Release virus definitions, version 2/24/04 rev 32 (60224af or 20040224.032) and greater, detect this threat.

---

Symantec Security Response has received an additional W32.Netsky.C@mm sample which is ASPacked. Response has seen no customer submissions of this minor variant at this time. Virus definitions of version 2/25/2004 rev 19 (60225s) (20040225.019) or greater are required to detect this variation.

Antivirus Protection Dates

• Initial Rapid Release version February 25, 2004
• Latest Rapid Release version February 25, 2004
• Initial Daily Certified version February 25, 2004
• Latest Daily Certified version February 25, 2004
• Initial Weekly Certified release date February 25, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High