Name: I-WORM.Netsky.B
AKA:
Type: Internet Worm
Size: 22016 byte
Platform: Win 95/98/ME/NT/2000/XP
Description:
This worm comes from an infected email attachment.
The email sender is not the real one, the worm will create an email with the sender taken from a random contact of the infected user.
The message has the following Subjects:
unknown
fake
stolen
information
warning
something
for you
read it immediately
hello
hi
With the following message bodies:
something is fool
something is going wrong
you are bad you try to steal
you feel the same
you earn money
thats wrong why?
take it easy
reply
do you? that's funny
here, the cheats
here, the introduction
here, the serials
from the chatter
about me
information about you
something is going wrong!
stuff about you?
greetings
see you here it is
that is bad yes, really?
i found this document about you your name is wrong
i hope it is not true!
kill the writer of this document!
something about you!
I have your password!
you are a bad writer
is that from you?
i wait for a reply! is that your account?
is that your name?
is that true?
here
my hero read it immediately!
here is the document.
read the details.
i'm waiting ok
what does it mean?
anything ok?
The worm could attach one of these infected files:
misc
party
disco
part2
mail2
object
ranking
dinner
release
final
location
jokes
friend
website
mails
story
found
nomoney
aboutyou
shower
ps
topseller
product
swimmingpool
bill
note
concert
textfile
posting
stuff
me
attachment
details
creditcard
message
talk
doc
msg
document
with the following file extensions: .pif .com .scr .exe
If executed, the worm creates a file named WINLOGON.EXE inside WINDOWS' folder
and will edit the registry to execute that file at windows' startup, at the end it shows this error message:
The file could not be opened!
Once the worm is active, it creates these files:
doom2.doc.pif
sex sex sex sex.doc.exe
rfc compilation.doc.exe
dictionary.doc.exe
win longhorn.doc.exe
e.book.doc.exe
programming basics.doc.exe
how to hack.doc.exe
max payne 2.crack.exe
e-book.archive.doc.exe
virii.scr
nero.7.exe
eminem - lick my pussy.mp3.pif
cool screensaver.scr
serial.txt.exe
office_crack.exe
hardcore porn.jpg.exe
angels.pif
porno.scr
matrix.scr
photoshop 9 crack.exe
strippoker.exe
dolly_buster.jpg.pif
winxp_crack.exe
Netsky worm will retrieve email addresses from these kind of files: .msg .oft .sht
.dbx .tbb .adb .doc .wab .asp .uin .rtf
.vbs .html .htm .pl .php .txt .eml
Any information published on our site may be used and published on other websites, blogs, forums, facebook and/or in any other form both in paper and electronic form as long as the source is always and in any case cited explicitly “Source: CRAM by TG Soft www.tgsoft.it” with a clickable link to the original information and / or web page from which textual content, ideas and / or images have been extrapolated.
It will be appreciated in case of use of the information of C.R.A.M. by TG Soft www.tgsoft.it in the report of summary articles the following acknowledgment/thanks “Thanks to Anti-Malware Research Center C.R.A.M. by TG Soft of which we point out the direct link to the original information: [direct clickable link]”
