Virus name:   Netsky.


Status:   Real.

Origins:   Netsky is a mass-mailing worm that affects only Microsoft NT and Windows-based systems. It spreads by sending itself as an e-mail attachment to addresses found on victims’ machines and by copying itself to shared folders to spread via P2P and local networks.

The e-mail messages through which Netsky spreads itself are quite short (a one-line message body, accompanying an attachment with a relatively short filename), but they can be difficult to keep track of because Netsky draws from a large list of variable names for its subject lines and message text.

A Netsky-infected e-mail may bear one of the following words or phrases as its subject line or message body:


  • *lol*

  • ;-)

  • <09580985869gj>

  • a crazy doc about you

  • abuse?

  • account?

  • already?

  • another pic, have fun! … :->

  • Antispam is turned off. See file!

  • are you a photographer?

  • are you a teacherin the picture?

  • are you cranky?

  • are you the naked one?

  • are you the naked person!

  • are you the one?

  • attachi#

  • Authentification required. Read the attachment!

  • be mad?

  • believe me

  • best?

  • bob the builder

  • child or adult?

  • child porn?

  • classroom test of you?

  • copyright?

  • correct it!

  • dear

  • Delivery Failed

  • denied!

  • did you ask me for that?

  • did you know from this document?

  • did you know that?

  • did you see her already?

  • did you sent it to me?

  • do not give up!

  • do not open the attachment!

  • do not show this anyone!

  • do not use my document!

  • do not use this creditcard!

  • do not visit the pages on the list I sent!

  • do you have an orgasm in the picture?

  • do you have sex in the picture?

  • do you have the bug also?

  • do you have?

  • do you know the thief?

  • do you know this????

  • do you think so?

  • doc about me?

  • doc?

  • docs?

  • does it belong to you?

  • does it match?

  • does it matter?

  • drugs? …

  • error

  • excellent!

  • exception

  • excuse me

  • explain!

  • fake?

  • fast food…

  • feel free to use it.

  • File is bad.

  • File is damaged.

  • File is self-decryting.

  • forgotten?

  • from the chatter (my photo!)

  • from your lover ;-)

  • gonna?

  • good morning

  • good work!

  • great job!

  • great xxx!

  • great!

  • greetings

  • hello

  • help attached

  • her.

  • here is it.

  • Here is it

  • here is my advice.

  • here is my photo!

  • here is the $%%454$

  • here is the

  • here is the document.

  • here is the next one!

  • here is yours!

  • here, the cheats

  • here, the introduction

  • here, the serials

  • hey

  • hi

  • how?

  • i am desperate

  • i am speachless about your document!

  • I don’t know your document!

  • i don’t think so.

  • i don’t want your xxx pics!

  • i found that about you!

  • i found this document about you.

  • i have received this.

  • I have your password!

  • i hope thats not true!

  • i know your document!

  • i like your doc!

  • i lost that

  • i need you!

  • i saw you last week!

  • I ‘ve found your bill!

  • I wait for an answer!

  • i wait for your comment about it.

  • i want more…

  • illegal st. of you?

  • illegal…

  • I’m back!

  • important?

  • important

  • in your mind?

  • incest?

  • info

  • information about you?

  • instruct me about this!

  • is that criminal?

  • is that possible?

  • is that the reality?

  • is that true?

  • is that your account?

  • is that your attachment?

  • is that your beast?

  • is that your car?

  • is that your cd?

  • is that your creditcard?

  • is that your domain?

  • is that your family?

  • is that your finger?

  • is that your message?

  • is that your name?

  • is that your photo?

  • is that your porn pic?

  • is that your privacy?

  • is that your slip?

  • is that your TAN?

  • is that your website?

  • is that your wife?

  • is that your work?

  • is that yours?

  • is the pic a fake?

  • is this information about you?

  • it’s a secret!

  • its me

  • its private from me

  • it’s so similar as yours!

  • i’ve found it about you

  • kill him on the picture!

  • kill the writer of this document!

  • last chance!

  • let it!

  • lets talk about it!

  • Login required! Read the attachment!

  • lol

  • love letter?

  • man or women?

  • meaning of that?

  • message?

  • Microsoft

  • misc. and so on. see you!

  • modifications?

  • moin

  • money?

  • msg

  • my advice….

  • never!

  • new patch is available!

  • notice!

  • notification

  • oh

  • ok…

  • old photos about you?

  • only encrypted!

  • pages?

  • personal message!

  • picture?

  • poor quality!

  • possible?

  • pretty pic about you?

  • private?

  • pwd?

  • Question

  • question

  • Re: <5664ddff?$??§2>

  • Re: does it?

  • Re: excuse me

  • Re: hello

  • Re: hey

  • Re: hi

  • Re: important

  • Re: information

  • Re: Re: Re: Re:

  • Re: unknown

  • re:

  • read it immediatelly

  • read it immediately!

  • read the details.

  • really?

  • reply

  • report

  • schoolfriend?

  • see this!

  • see your name!

  • solve the problem!

  • something about you!

  • something for you

  • something is going …

  • something is going wrong!

  • something is not ok

  • Status

  • stolen

  • stuff about you?

  • such as yours?

  • take it easy!

  • take it

  • tell me more about your document!

  • test it

  • that is interesting…

  • that’s a funny text.

  • that’s not the truth?

  • thats wrong!

  • the information is wrong!

  • the truth?

  • this file is bad!

  • this is an attachment message!

  • this is nothing for kids!

  • time to fear?

  • Transaction failed. Show the doc!

  • trial?

  • trust me

  • try this patch!

  • warning

  • what do you think about it?

  • what means that?

  • what still?

  • what?

  • what’s up?

  • who?

  • why should I?

  • why?

  • wrong calculation! (see the attachment!)

  • xxx ?

  • xxx about you?

  • xxx service

  • Yep

  • yes.

  • you are a bad writer

  • you are bad

  • You are infected. Read the details!

  • you are naked in this document!

  • you are sexy in this doc!

  • you cannot hide yourself! (see photo)

  • you earn money, see the attachment!

  • you feel the same.

  • you have a postcard from Hawaii

  • you have a sexy body in the pic!

  • you have done a mistake in the document!

  • you have tried to steal!

  • you look like an ape!

  • you look like an rat?

  • you won the rk!

  • you?

  • your account is expired!

  • your are naked?

  • your attachment? verify it.

  • Your bill.

  • your body?

  • your design is not good!

  • your document is not good

  • your document is silly!

  • your eyes?

  • your face?

  • your hero in the picture?

  • your icq number?

  • your job? (I found that!)

  • your lie is going around the world!

  • your name is wrong!

  • your personal record?

  • your photo is poor

  • Your provider will be disabled!

  • your TAN number?

  • yours?

A Netsky e-mail will include an attachment with any of the following as its filename:


  • aboutyou

  • associal

  • attach2

  • auction

  • transfer

  • bill

  • birth

  • card

  • concert

  • moonlight

  • death

  • details

  • description

  • creditcard

  • dinner

  • disco

  • doc

  • yours

  • doc_ang

  • jokes

  • document

  • final

  • found

  • freaky

  • image

  • incest

  • information

  • sexy

  • injection

  • intimate stuff

  • letter

  • location

  • mail2

  • mails

  • masturbation

  • material

  • me

  • message

  • talk

  • msg2

  • music

  • myaunt

  • mydate

  • naked1

  • naked2

  • news

  • nomoney

  • note

  • nothing

  • misc

  • number_phone

  • object

  • old_photos

  • part2

  • party

  • paypal

  • pic

  • attachment

  • portmoney

  • posting

  • poster

  • privacy

  • id

  • product

  • class_photos

  • ps

  • ranking

  • regards

  • website

  • more

  • regid

  • release

  • response

  • schock

  • secrets

  • sexual

  • shower

  • story

  • stuff

  • swimmingpool

  • tear

  • textfile

  • topseller

  • trash

  • undefinied

  • unfolds

  • friend

  • update

  • violence

  • visa

  • warez

  • webcam

  • wife

  • word_doc

  • worker

  • your_stuff

A Netsky removal tool is available on the Symantec Security web site.

Additional Information:



  W32.Netsky.C@mm W32.Netsky.C@mm (Symantec)
  NetSky.C NetSky.C (F-Secure)
  W32/Netsky.c@MM W32/Netsky.c@MM (McAfee)

Last updated:   29 January 2008

 




  Sources Sources:

    Legon, Jeordan.   “Experts: Vicious Worm ‘Linux War’ Weapon.”

    CNN.   27 January 2004.