name: W32.Netsky
aka: moodown
type: Worm
host platform: Windows
first incidence: 2/16/04
level of incidence: High
damage capacity: High
links: Symantec - W32.Netsky.A, Symantec - W32.Netsky.B,
         Symantec - W32.Netsky.C, Symantec - W32.Netsky.D, 
         Symantec - W32.Netsky.E, Symantec - W32.Netsky.F,
         Symantec - W32.Netsky.G, Symantec - W32.Netsky.H,                 
         Symantec - W32.Netsky.K, Symantec - W32.Netsky.L,
         Symantec - W32.Netsky.M, Symantec - W32.Netsky.N,
         Symantec - W32.Netsky.O, Symantec - W32.Netsky.P,
         Symantec - W32.Netsky.Q, Symantec - W32.Netsky.R,
         Symantec - W32.Netsky.S, Symantec - W32.Netsky.T, Symantec - W32.Netsky.U
         McAfee - W32.Netsky.A, McAfee - W32.Netsky.B,
         McAfee - W32.Netsky.C, McAfee - W32.Netsky.D,
         McAfee - W32.Netsky.E, McAfee - W32.Netsky.F,
         McAfee - W32.Netsky.G, McAfee - W32.Netsky.K,
         McAfee - W32.Netsky.Q, McAfee - W32.Netsky.R, McAfee - W32.Netsky.S,

           
look for emails with the following characteristics:

   Subject:

Auction successful! Delivery Failed Status report question trust me hey Re: excuse me read it immediatelly hi Re: does it? Yep important hello dear Re: unknown fake? warning moin what's up? info Re: information Here is it stolen private? good morning illegal... error take it re: Re: Re: Re: Re: you? something for you exception Re: hey excuse me Re: hi Re: important Re: hello believe me Question denied! notification Re: <5664ddff?$??lol last chance! I'm back! its me notice! read it immediately information fake unknown Re: Your website Re: Your product Re: Your letter Re: Your archive Re: Your text Re: Your bill Re: Your details Re: My details Re: Word file Re: Excel file Re: Details Re: Approved Re: Your software Re: Your music Re: Here Re: Re: Re: Your document Re: Hello Re: Hi Re: Re: Message Re: Your picture Re: Here is the document Re: Your document Re: Thanks! Re: Re: Thanks! Re: Re: Document Re: Document Re: <5664ddff?$????> lol oh Announcement Re: Thank you Thank you Details Approved hi, it's me Thank You very very much You use illegal... Your IP was logged Love is Re: <censored> registered? Your request was registered read now! Attention Schedule You have 1 day left automatic notification Expired account automatic responder Read this message please read please reply Registration confirm Confirmation Confirmation Required Returned Mail Your file is attached. Please read the attached file. Please have a look at the attached file. See the attached file for details. Here is the file. Your document is attached. <Deliver Error> <Message Error> <Server Error> what means that? help attached <...> ok... <Attachment from Poland> that is interesting... i wait for your comment about it. such as yours? read the details. gonna? here is the document. *lol* read it immediately! i found that about you! your hero in the picture? yours? here is it. illegal st. of you? is that true? account? is that your name? picture? message? is that your account? pwd? I wait for an answer! abuse? is that yours? you are a bad writer I don't know your document! <Mail failed> I have your password! you won the rk! something about you! classroom test of you? kill the writer of this document! old photos about you? i hope thats not true! your name is wrong! does it match? i found this document about you. time to fear? really? do you know this???? i know your document! did you sent it to me? this file is bad! why should I? pages? her. another pic, have fun! ... :-> test it child porn? greetings xxx ? stuff about you? your document is not good something is going wrong! your photo is poor information about you? the information is wrong! doc about me? kill him on the picture! from the chatter (my photo!) from your lover ;-)

love letter? here, the serials are you a teacherin the picture? here, the introduction is that criminal? here, the cheats i like your doc! what do you think about it? that's a funny text. that's not the truth? do you have? instruct me about this! i lost that i am speachless about your document! is that the reality? reply msg your design is not good! important? your TAN number? take it easy! why? you are naked in this document! thats wrong! your icq number? i am desperate modifications? your personal record? yes. misc. and so on. see you! your attachment? verify it. you earn money, see the attachment! is that your attachment? is that your website? you feel the same. meaning of that? possible? you have tried to steal! did you ask me for that? you are bad your job? (I found that!) is that possible? something is going ... something is not ok did you know from this document? wrong calculation! (see the attachment!... never! poor quality! good work! excellent! great! i don't think so. pretty pic about you? docs? schoolfriend? <Warning from the Government> <09580985869gj> <?} i want more... here is the next one! attachi# did you see her already? is that your wife? is that your creditcard? is that your photo? do you think so? do you have the bug also? already? forgotten? drugs? ... does it matter? i have received this. best? the truth? your body? your eyes? your face? File is self-decryting. File is damaged. File is bad. i saw you last week! xxx service your account is expired! you cannot hide yourself! (see photo) copyright? what still? who? how? <bad gateway> only encrypted! personal message! my advice.... i've found it about you <<<Failure>>> <Attached Msg> <scanned by norton antivirus> great xxx! man or women? child or adult? here is yours! a crazy doc about you xxx about you? i don't want your xxx pics! <Failed message available> <Automailer> doc? trial? what? ;-) i need you! correct it! see this! it's a secret! this is nothing for kids! it's so similar as yours! is that your car? do not give up! great job! here is the $%%454$ you are sexy in this doc! incest? let it! you look like an ape! you look like an rat? be mad? are you cranky? bob the builder did you know that? money? is this information about you? is that your privacy? is that your TAN? is that your message? is that your cd? is that your finger? your are naked? is that your porn pic? is that your work? is that your family? is that your beast? is that your slip? is that your domain? are you the naked one? are you the naked person! are you the one? does it belong to you? do you have sex in the picture? you have a sexy body in the pic! your lie is going around the world! <Transfer complete> <Antispam complete> lets talk about it! do you know the thief? are you a photographer? you have done a mistake in the document... its private from me do not show this anyone! new patch is available! this is an attachment message! in your mind? Microsoft fast food... Your bill. try this patch! do you have an orgasm in the picture? <Click the attachment to decrypt> <Attachment Signature 34933920> Transaction failed. Show the doc! I 've found your bill! see your name! You are infected. Read the details! here is my advice. here is my photo! here is the <censored> feel free to use it. Login required! Read the attachment! your document is silly! is the pic a fake? Antispam is turned off. See file! Authentification required. Read the att... solve the problem! <null>

do not use my document! do not use this creditcard! do not open the attachment! do not visit the pages on the list I se... explain! tell me more about your document! Your provider will be disabled! Instant patches. Re: Your briefing Re: Your loveletter Re: Your TAN Re: Your PIN Re: Zipped folder Re: Secound Part Re: Part 3 Re: Part 2 Re: Your application Re: Your data Re: Index Re: Appending Re: Your encrypted file Re: Your folder Re: Your file Re: Yours Re: Here the file Re: Samples Re: Important Re: <username> Requested file Re: <username> My file Re: <username> My document Re: <username> My information Re: <username> My details Re: <username> Information Re: <username> Improved Re: <username> Requested document Re: <username> Document Re: <username> Details Re: <username> Your document Re: <username> Your details Re: <username> Approved Re: My Re: Your Re: Re: My Re: Re: Your Re: Encrypted Mail Re: Extended Mail Re: Status Re: Notify Re: SMTP Server Re: Mail Server Re: Delivery Server Re: Bad Request Re: Failure Re: Thank you for delivery Re: Test Re: Administration Re: Message Error Re: Error Re: Extended Mail System Re: Secure SMTP Message Re: Protected Mail Request Re: Protected Mail System Re: Protected Mail Delivery Re: Secure delivery Re: Delivery Protection Re: Mail Authentification Mail Delivery (failure ) Re: Request Re: Order Notice again Fwd: Warning again Re: List Re: Developement Re: Proof of concept Re: Error in document Re: Message Re: Sex pictures Re: Free porn Re: Virus Sample Re: Submit a Virus Sample Re: Old photos Re: Old times Re: Question Re: Sample Re: Its me Stolen document Private document Re: Approved document Try this game ;-) Deliver Mail <Recipient's Address> Delivered Message <Recipient's Address> Delivery <Recipient's Address> Delivery Bot <Recipient's Address> Delivery Error <Recipient's Address> Delivery Failed <Recipient's Address> Delivery Failure <Recipient's Address> Error <Recipient's Address> Failed <Recipient's Address> Failure <Recipient's Address> Mail Delivery failure <Recipient's Address> Mail Delivery System <Recipient's Address> Mail System <Recipient's Address> Server Error <Recipient's Address> Status <Recipient's Address> Unknown Exception <Recipient's Address> Hello! Hi! Important My details Re: Your information Your information Your details Your document Request Re: Thanks you! Thank you! Hello Approved file List Corrected document Archive Abuse list Presentation document Instructions Improved document Note Message Contact list Number list File Secound document Improved file User list Textfile New document Text Information Info Word document Excel document Powerpoint document Detailed document Homepage Letter Mail Document Old document Approved document Movie document Picture document Summary Description Requested document Notice Bill Answer Release Final version Diggest Important document Order Photo document Personal message Phone number Email Icq number Report Story Concept Developement Sample Postcard Account Hi Hey It's me Again Reply

   Message (potentially followed by false claim that the message has been virus-scanned):

#----------------- message was sent by automail agent ------------------#     Congratulations!     You were successful in the auction.     Auction ID :<4 random digits>-<4 random digits>-<4 random digits>-A     Product ID :<4 random digits>-<4 random digits>-<4 random digits>-P     A detailed description about the product and the bill     are attached to this mail.     Please contact the seller immediately.     Thank you! Thank you! <Deliver Error> <Message Error> <Server Error> what means that? help attached <...> ok... <Attachment from Poland> that is interesting... i wait for your comment about it. such as yours? read the details. gonna? here is the document. *lol* read it immediately! i found that about you! your hero in the picture? yours? here is it. illegal st. of you? is that true? account? is that your name? picture? message? is that your account? pwd? I wait for an answer! abuse? is that yours? you are a bad writer I don't know your document! <Mail failed> I have your password! you won the rk! something about you! classroom test of you? kill the writer of this document! old photos about you? i hope thats not true! your name is wrong! does it match? i found this document about you. time to fear? really? do you know this???? i know your document! did you sent it to me? this file is bad! why should I? pages? her. another pic, have fun! ... :-> test it child porn? greetings xxx ? stuff about you? your document is not good something is going wrong! your photo is poor information about you? the information is wrong! doc about me? kill him on the picture! from the chatter (my photo!) from your lover ;-) love letter? here, the serials are you a teacherin the picture? here, the introduction is that criminal? here, the cheats i like your doc! what do you think about it? that's a funny text. that's not the truth? do you have? instruct me about this! i lost that i am speachless about your document! is that the reality? reply msg your design is not good! important? your TAN number? take it easy! why? you are naked in this document! thats wrong! your icq number? i am desperate modifications? your personal record? yes. misc. and so on. see you! your attachment? verify it. you earn money, see the attachment! is that your attachment? is that your website? you feel the same. meaning of that? possible? you have tried to steal! did you ask me for that? you are bad your job? (I found that!) is that possible? something is going ... something is not ok did you know from this document? wrong calculation! (see the attachment!... never! poor quality! good work! excellent! great! i don't think so. pretty pic about you? docs? schoolfriend? <Warning from the Government> <09580985869gj> <?} i want more... here is the next one! attachi# did you see her already? is that your wife? is that your creditcard? is that your photo? do you think so? do you have the bug also? already? forgotten? drugs? ... does it matter? i have received this. best? the truth? your body? your eyes? your face? File is self-decryting. File is damaged. File is bad. i saw you last week! xxx service your account is expired! you cannot hide yourself! (see photo) copyright? what still? who? how? <bad gateway> only encrypted! personal message! my advice.... i've found it about you <<<Failure>>> <Attached Msg> <scanned by norton antivirus> great xxx! man or women? child or adult? here is yours! a crazy doc about you xxx about you? i don't want your xxx pics! <Failed message available> <Automailer> doc? trial? what? ;-) i need you! correct it! see this! it's a secret! this is nothing for kids! it's so similar as yours! is that your car? do not give up! great job! here is the $%%454$ you are sexy in this doc! incest? let it! you look like an ape! you look like an rat? be mad? are you cranky? bob the builder did you know that? money? is this information about you? is that your privacy? is that your TAN? is that your message? is that your cd? is that your finger? your are naked? is that your porn pic? is that your work? is that your family? is that your beast? is that your slip? is that your domain? are you the naked one? are you the naked person! are you the one? does it belong to you? do you have sex in the picture? you have a sexy body in the pic! your lie is going around the world! <Transfer complete> <Antispam complete> lets talk about it! do you know the thief? are you a photographer? you have done a mistake in the document... its private from me do not show this anyone! new patch is available! this is an attachment message! in your mind? Microsoft fast food... Your bill. try this patch! do you have an orgasm in the picture? <Click the attachment to decrypt> <Attachment Signature 34933920> Transaction failed. Show the doc! I 've found your bill! see your name! You are infected. Read the details! here is my advice. here is my photo! here is the <censored> feel free to use it. Login required! Read the attachment! your document is silly! is the pic a fake? Antispam is turned off. See file! Authentification required. Read the att... solve the problem! <null> do not use my document! do not open the attachment! do not visit the pages on the list I se...

explain! tell me more about your document! Your provider will be disabled! Instant patches. anything ok? what does it mean? ok i'm waiting my hero here i wait for a reply! is that from you? i hope it is not true! your name is wrong i found this document about you yes, really? that is bad here it is see you information about you about me from the chatter that's funny do you? take it easy thats wrong misc you earn money you feel the same you try to steal something is going wrong something is fool Your file is attached Please read the attached file Please have a look at the attached See the attached file for details Here is the file Your document is attached. Your file is attached. Please read the attached file. Please have a look at the attached file. See the attached file for details. Here is the file. Please read the document. Please see the attached file for details. Details for <attachment>. Document <attachment>. I have received your document. The improved document <attachment> is attached. I have attached your document <attachment>. Your document <attachment> is attached to this mail. Authentification for <attachment> required. Requested file <attachment>. See the file <attachment>. Please read the important message msg_<attachment>. Please confirm the document <attachment>. <attachment> is attached. Your file <attachment> is attached. Please read the document <attachment>. Your document <attachment> is attached. Please read the attached file <attachment>. Please see the attached file <attachment> for details.. Authentication required. I have attached your document. I have received your document. The corrected document is attached. Please confirm the document. Please read the important document. Requested file. See the file. Your details. Your document is attached to this mail. Your document. Please confirm my request. ESMTP [Secure Mail System #334]: Secure message is attached. Partial message is available. Waiting for a Response. Please read the attachment. First part of the secure mail is available. For more details see the attachment. For further details see the attachment. Your requested mail has been attached. Protected Mail System Test. Secure Mail System Beta Test. Forwarded message is available. Delivered message is attached. Encrypted message is available. Please read the attachment to get the message. Follow the instructions to read the message. Please authenticate the secure message. Protected message is attached. Waiting for authentification. Protected message is available. Bad Gateway: The message has been attached. SMTP: Please confirm the attached message. You got a new message. Now a new message is available. New message is available. You have received an extended message. Please read the instructions. Important message, do not show this anyone! Your important document, correction is finished! The sample is attached! I hope you accept the result! Please answer quickly! Please confirm! Are you a spammer? (I found your email on a spammer website!?!) I have visited this website and I found you in the spammer list. Is that true? Here is my phone number. Here is my icq list. You have downloaded these illegal cracks?. Do not visit this illegal websites! Here is it! Try this, or nothing! Let'us be short: you have no experience in writing letters!!! I am shocked about your document! You cannot do that! Shocking document Thanks! Thank you for your request, your details are attached! You have written a very good text, excellent, good work! Your photo, uahhh.... , you are naked! Does it matter? Do you? Monthly news report. Your archive is attached. I cannot forget you! I love you! I have attached the sample. I have corrected your document. The file is protected with the password ghj001. I have attached your file. Your password is jkl44563. I cannot believe that. I found this document about you. I hope the patch works. Message has been sent as a binary attachment. Binary message is available. I have attached it to this mail. Can you confirm it? Is that your password? Mail Authentication Protected Mail System ESMTP [Secure Mail System #334]: Secure message is attached. Please read the attached file! read it immediately Delivery Agent - Translation failed Delivery Failure - Invalid mail specification Mail Delivery - This mail couldn't be displayed Mail Delivery Error - This mail contains unicode characters Mail Delivery Failed - This mail couldn't be represented Mail Delivery Failure - This mail couldn't be shown. Mail Delivery System - This mail contains binary characters Mail Transaction Failed - This mail couldn't be converted Note that I have attached your document. My <attachment>. The <attachment>. I have spent much time for the <attachment>. I have spent much time for your document. Your <attachment>. Please notice the attached <attachment>. Please notice the attached document. Please read quickly. For more details see the attached document. For more information see the attached document. Approved, here is the document. I have found the <attachment>. My <attachment> is attached. Your <attachment> is attached. Please, <attachment>. Your file is attached to this mail. Please read the attached document. Please have a look at the attached document. See the document for details. Here is the document. The requested <attachment> is attached! I have sent the <attachment>. Please see the <attachment>. The <attachment> is attached. Here is the <attachment>. Please have a look at the <attachment>. Please read the <attachment>. Oh, I got it! To less characters! Take it easy... I noticed your password for administrative purpuses. Yet another password! Need a better one? Oh... your password! Need a better password? my advice.... Your pwd is critical, too short, to low! Do not use personal information for your password! Your password on a website? Passwordlist? yours? I needed only 2 hours to get your password. Change your password! I have stolen some text, excuse me! Dictionary attacks are good. Your password not! I used the brute-force method to get your password.. Take it easy... Your password is too short. I've got your password! take it easy... Hey, easy passwords! Oh! Excuse me, your password is too easy!!! Not with me! Here is a sample of your private documents I have stolen! Your privacy! lol, youre not protected! Needed? No, here I give it back! I believe from the document you are a child! Check your document, errors are there! Please, please, Give me another sexy document about you! Short and good, your document! Jooooooooo.... document? Yours????? Wehaaa! I do not accept documents from bad guys! I do not want your document! Go to hell an burn with your bad document! I will send your list to the police!!!! Hello, here. It's the truth, your document not!!! Could I have more texts about you? Thus is enough. Stop sending your Sh*tty documents!!! One, two three, more, I have many questions to you document!' Nice, nice, more and more? do you? Should I believe it? No, however, your story is bad. Oh.....puh, your story is very strong! Yours is very nice! Do you have more of that? Hey ya, nice document. Do you have more? Abou you? Sexy pic abou you? Do you have a digicam to make your private photos? More naked...your body is sexy! Naked, you? Are you naked? More private photos of you? no! Private photos...mmmhh. I like it. Post me more please! Hey, naked one! Hey, have you ever seen your photo? Eat my Sh*t! Your photo is bad. Do not distribute your naked photos! Uhaaa! naked... are you cranky? Your are naked? Tell me more...please! Hey, private or private..naked? Pah!...take your private photo, naked and so, and go away. I have sent your private photo to the police. What is when I show your private illegal photo the police? You? Very funny! More available? I don't want to see your photo! Sh*t... your photo! naked?

   Attachment:

prod_info_<randomnumber> document msg doc talk message creditcard details attachment me stuff posting textfile concert information note bill swimmingpool product topseller ps shower aboutyou nomoney found story mails website friend jokes location final release dinner ranking object mail2 part2 disco party misc associal yours wife response description pic trash card poster portmoney moonlight sexy news number_phone mydate class_photos old_photos important myaunt birth death worker letter more regards regid unfolds doc_ang your_stuff 454543403 schock webcam intimate stuff sexual secrets attach2 msg2 freaky visa material nothing transfer auction warez undefinied violence update masturbation injection naked1 naked2 tear music paypal id privacy word_doc image

incest your_website your_product your_letter your_archive your_text your_bill your_details document_word document_excel my_details all_document application mp3music document_4351 your_file message_details your_picture document_full message_part2 your_document your_briefing your_pic your_tan_33 your_pin_88 your_smaples your_file_<username> details_<username> document_<username> <username> improved_<username> message_<username> detailed_<username> your_document_<username> word_doc_<username> doc_<username> articel_<username> picture_<username> file_<username> application_<username> approved_<username> bill_<username> data_<username> document_all_<username> excel document_<username> important_<username> information_<username> letter_<username> product_<username> screensaver_<username> text_<username> website_<username> word document_<username> readme data document05 websites03 game_xxo your_doc mails9 data20 letter32 priv document43 software patch3425 game private_01 part6 document01 pwd02 all_doc01 document04 about_you encrypted_msg01 pgp_sess01 data.eml[100 space characters] mail.eml[100 space characters] msg.eml[100 space characters] message.eml[100 space characters] mail approved_file<randomnumber> list<randomnumber> corrected_document<randomnumber> archive<randomnumber> abuse_list<randomnumber> presentation_document<randomnumber> instructions<randomnumber> details<randomnumber> improved_document<randomnumber> note<randomnumber> message<randomnumber> contact_list<randomnumber> number_list<randomnumber> file<randomnumber> secound_document<randomnumber> improved_file<randomnumber> user_list<randomnumber> textfile<randomnumber>

new_document<randomnumber> text<randomnumber> information<randomnumber> info<randomnumber> word_document<randomnumber> excel_document<randomnumber> powerpoint_document<randomnumber> detailed_document<randomnumber> homepage<randomnumber> letter<randomnumber> mail<randomnumber> document<randomnumber> old_document<randomnumber> approved_document<randomnumber> movie_document<randomnumber> picture_document<randomnumber> summary<randomnumber> description<randomnumber> requested_document<randomnumber> notice<randomnumber> bill<randomnumber> answer<randomnumber> release<randomnumber> final_version<randomnumber> diggest<randomnumber> important_document<randomnumber> order<randomnumber> photo_document<randomnumber> personal_message<randomnumber> phone_number<randomnumber> email<randomnumber> icq_number<randomnumber> report<randomnumber> story<randomnumber> concept<randomnumber> developement<randomnumber> sample<randomnumber> postcard<randomnumber> account<randomnumber> yours_funny yours_naked_img not_permitted img05 yours_naked yoursnaked yourphoto yourimage pic04 yournakedpic yourpic private your_private_document xxx_yours_naked your_bad_photo private_photo private_pic your_photo photo03 yourdoc yourdocument mydocument onedocument your_doc04 founddocument document3 anotherdocument document_part alldoc shortdoc doc04 illegaldocument abusedocument posteddocument trieddocument yetanotherdocument sexydocument abuses morestory doc_ed approvdoc detailed listed correct_pass pass01 pwds04 password02 pwd yourspwd your_pwd your_password pwd_list passwords password yourpassword easypassword cracked_password morepasswords

with the first potential extension of:

txt rtf doc htm gif jpg

and second potential extension of:

exe scr com pif bat zip (containing the worm)

Unlike many worms which only spread themselves through email attachments, W32.Netsky also copies itself in the found mapped drives of the infected machine. It also attempts to spread itself through Peer-to-Peer programs, e.g. Kazaa, by dropping itself in folders named 'sharing' or 'shared'.

The worm has mutated since its initial release. The latest mutation of the virus is W32.Netsky.U. Symantec has developed a removal tool for variants of Netsky. The removal tool and instructions can be found here.

For info on computer viruses and guidelines for avoiding them, please see http://www.greenapple.com/support/library/virus-faq.htm

If you believe you have become infected or have any questions regarding viruses, please do not hesitate to contact us. As always, as a Green Apple user you are welcome to bring in your computer for us to examine and, where possible, fix.
 

Home / Access / Development / Support / Hosting / Local Links / Computers
 Contact Us / Green Apple News / Jobs / Site Map / Link To Us / Policy

Lancaster-Fairfield County Chamber of Commerce, 2000 Small Business of the Year
www.greenapple.com · tel. (740) 653-9890 · toll free. (866) 653-9890
Copyright © 1995 - 2007, Green Apple, Inc.