Virus name:   Netsky.

Status:   Real.

Origins:   Netsky is a mass-mailing worm that affects only Microsoft NT and Windows-based systems. It spreads by sending itself as an e-mail attachment to addresses found on victims' machines and by copying itself to shared folders to spread via P2P and local networks.

The e-mail messages through which Netsky spreads itself are quite short (a one-line message body, accompanying an attachment with a relatively short filename), but they can be difficult to keep track of because Netsky draws from a large list of variable names for its subject lines and message text.

A Netsky-infected e-mail may bear one of the following words or phrases as its subject line or message body:

• *lol*
• ;-)
• <09580985869gj>
• a crazy doc about you
• abuse?
• account?
• already?
• another pic, have fun! ... :->
• Antispam is turned off. See file!
• are you a photographer?
• are you a teacherin the picture?
• are you cranky?
• are you the naked one?
• are you the naked person!
• are you the one?
• attachi#
• Authentification required. Read the attachment!
• be mad?
• believe me
• best?
• bob the builder
• child or adult?
• child porn?
• classroom test of you?
• copyright?
• correct it!
• dear
• Delivery Failed
• denied!
• did you ask me for that?
• did you know from this document?
• did you know that?
• did you see her already?
• did you sent it to me?
• do not give up!
• do not open the attachment!
• do not show this anyone!
• do not use my document!
• do not use this creditcard!
• do not visit the pages on the list I sent!
• do you have an orgasm in the picture?
• do you have sex in the picture?
• do you have the bug also?
• do you have?
• do you know the thief?
• do you know this????
• do you think so?
• doc about me?
• doc?
• docs?
• does it belong to you?
• does it match?
• does it matter?
• drugs? ...
• error
• excellent!
• exception
• excuse me
• explain!
• fake?
• fast food...
• feel free to use it.
• File is bad.
• File is damaged.
• File is self-decryting.
• forgotten?
• from the chatter (my photo!)
• from your lover ;-)
• gonna?
• good morning
• good work!
• great job!
• great xxx!
• great!
• greetings
• hello
• help attached
• her.
• here is it.
• Here is it
• here is my advice.
• here is my photo!
• here is the $%%454$
• here is the
• here is the document.
• here is the next one!
• here is yours!
• here, the cheats
• here, the introduction
• here, the serials
• hey
• hi
• how?
• i am desperate
• i am speachless about your document!
• I don't know your document!
• i don't think so.
• i don't want your xxx pics!
• i found that about you!
• i found this document about you.
• i have received this.
• I have your password!
• i hope thats not true!
• i know your document!
• i like your doc!
• i lost that
• i need you!
• i saw you last week!
• I 've found your bill!
• I wait for an answer!
• i wait for your comment about it.
• i want more...
• illegal st. of you?
• illegal...
• I'm back!
• important?
• important
• in your mind?
• incest?
• info
• information about you?
• instruct me about this!
• is that criminal?
• is that possible?
• is that the reality?
• is that true?
• is that your account?
• is that your attachment?
• is that your beast?
• is that your car?
• is that your cd?
• is that your creditcard?
• is that your domain?
• is that your family?
• is that your finger?
• is that your message?
• is that your name?
• is that your photo?
• is that your porn pic?
• is that your privacy?
• is that your slip?
• is that your TAN?
• is that your website?
• is that your wife?
• is that your work?
• is that yours?
• is the pic a fake?
• is this information about you?
• it's a secret!
• its me
• its private from me
• it's so similar as yours!
• i've found it about you
• kill him on the picture!
• kill the writer of this document!
• last chance!
• let it!
• lets talk about it!
• Login required! Read the attachment!
• lol
• love letter?
• man or women?
• meaning of that?
• message?
• Microsoft
• misc. and so on. see you!
• modifications?
• moin
• money?
• msg
• my advice....
• never!
• new patch is available!
• notice!
• notification
• oh
• ok...
• old photos about you?
• only encrypted!
• pages?
• personal message!
• picture?
• poor quality!
• possible?
• pretty pic about you?
• private?
• pwd?
• Question
• question
• Re: <5664ddff?$??§2>
• Re: does it?
• Re: excuse me
• Re: hello
• Re: hey
• Re: hi
• Re: important
• Re: information
• Re: Re: Re: Re:
• Re: unknown
• re:
• read it immediatelly
• read it immediately!
• read the details.
• really?
• reply
• report
• schoolfriend?
• see this!
• see your name!
• solve the problem!
• something about you!
• something for you
• something is going ...
• something is going wrong!
• something is not ok
• Status
• stolen
• stuff about you?
• such as yours?
• take it easy!
• take it
• tell me more about your document!
• test it
• that is interesting...
• that's a funny text.
• that's not the truth?
• thats wrong!
• the information is wrong!
• the truth?
• this file is bad!
• this is an attachment message!
• this is nothing for kids!
• time to fear?
• Transaction failed. Show the doc!
• trial?
• trust me
• try this patch!
• warning
• what do you think about it?
• what means that?
• what still?
• what?
• what's up?
• who?
• why should I?
• why?
• wrong calculation! (see the attachment!)
• xxx ?
• xxx about you?
• xxx service
• Yep
• yes.
• you are a bad writer
• you are bad
• You are infected. Read the details!
• you are naked in this document!
• you are sexy in this doc!
• you cannot hide yourself! (see photo)
• you earn money, see the attachment!
• you feel the same.
• you have a postcard from Hawaii
• you have a sexy body in the pic!
• you have done a mistake in the document!
• you have tried to steal!
• you look like an ape!
• you look like an rat?
• you won the rk!
• you?
• your account is expired!
• your are naked?
• your attachment? verify it.
• Your bill.
• your body?
• your design is not good!
• your document is not good
• your document is silly!
• your eyes?
• your face?
• your hero in the picture?
• your icq number?
• your job? (I found that!)
• your lie is going around the world!
• your name is wrong!
• your personal record?
• your photo is poor
• Your provider will be disabled!
• your TAN number?
• yours?

A Netsky e-mail will include an attachment with any of the following as its filename:

• aboutyou
• associal
• attach2
• auction
• transfer
• bill
• birth
• card
• concert
• moonlight
• death
• details
• description
• creditcard
• dinner
• disco
• doc
• yours
• doc_ang
• jokes
• document
• final
• found
• freaky
• image
• incest
• information
• sexy
• injection
• intimate stuff
• letter
• location
• mail2
• mails
• masturbation
• material
• me
• message
• talk
• msg2
• music
• myaunt
• mydate
• naked1
• naked2
• news
• nomoney
• note
• nothing
• misc
• number_phone
• object
• old_photos
• part2
• party
• paypal
• pic
• attachment
• portmoney
• posting
• poster
• privacy
• id
• product
• class_photos
• ps
• ranking
• regards
• website
• more
• regid
• release
• response
• schock
• secrets
• sexual
• shower
• story
• stuff
• swimmingpool
• tear
• textfile
• topseller
• trash
• undefinied
• unfolds
• friend
• update
• violence
• visa
• warez
• webcam
• wife
• word_doc
• worker
• your_stuff

A Netsky removal tool is available on the Symantec Security web site.

Additional Information:

	W32.Netsky.C@mm (Symantec)
	NetSky.C (F-Secure)
	W32/Netsky.c@MM (McAfee)

Last updated:   29 January 2008

Urban Legends Reference Pages © 1995-2013 by Barbara and David P. Mikkelson.
This material may not be reproduced without permission.
snopes and the snopes.com logo are registered service marks of snopes.com.  

---

  Sources:

    Legon, Jeordan.   "Experts: Vicious Worm 'Linux War' Weapon."

    CNN.   27 January 2004.