http://www.sarc.com/avcenter/venc/data/w32.netsky.w@mm.html
http://vil.nai.com/vil/content/v_104470.htm
http://www.techweb.com/wire/story/TWB20040416S0007
http://www.f-secure.com/v-descs/netsky_w.shtml
http://www.pandasoftware.com/virus_info/en...x?idvirus=46390
NetSky.W worm variant was discovered on April 16th, 2004. This variant is very closely related to the "N" and "P" variants. It is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives.
The "sender" of the email is spoofed, and its subject, message body, and attachment vary. The attachment has .exe, .pif, .scr or .zip as extension types.
It deletes the entries belonging to several worms, including Mydoom.A, Mydoom.B, Mimail.T and several variants of Bagle (so the virus wars continue). The bad news is this could potentially escalate new variants among all these families.
Back to top
