1. Symantec/
  2. Security Response/
  3. W32.Netsky.I@mm


Risk Level 2: Low

March 8, 2004
March 8, 2004 2:28:24 PM
Infection Length:
22,016 bytes
Systems Affected:
W32.Netsky.I@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.

The Subject, Body, and Attachment vary.

  • Rapid Release definitions version 60307b (extended version 3/7/2004 rev. 2) or higher will detect this threat.
  • The worm has an MD5 hash value of 0xB0E2280F6E952C46D47E563A7C219148.
  • The worm is packed by PE-Pack.
  • Misleading Applications, also known as Rogue Security Software, are fake antivirus programs that display fake virus infection alerts in order to trick users into downloading or paying for the application. Two commonly reported fake infections are “Worm.Win32.Netsky” and “Win32.Netsky.Q”.

    While similar to the name of the threat in this writeup, these fake detections are not related, and running the removal tool will report that no instances of the threat were found on your computer. For more information about Misleading Applications, see the recent Symantec Report on Rogue Security Software.

Antivirus Protection Dates

  • Initial Rapid Release version March 8, 2004
  • Latest Rapid Release version August 8, 2016 revision 023
  • Initial Daily Certified version March 8, 2004
  • Latest Daily Certified version August 9, 2016 revision 001
  • Initial Weekly Certified release date March 8, 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Hiroshi Shinotsuka

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube