Skip to Content.
Sympa Menu

baslinux - Re: [BL] Re: Order

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: Sindi Keesan <keesan AT iamjlamb.com>
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] Re: Order
  • Date: Fri, 30 Apr 2004 10:30:15 -0400 (EDT)

On Fri, 30 Apr 2004, Matrix Mole wrote:

> On Thu, 29 Apr 2004, Sindi Keesan wrote:
>
> > Would any users of Windows mail programs on this list please check for the
> > netsky.b virus? You can read about it online and look for a particular
> > filename in your computer. DOS users can download f-prot antivirus
> > software and use it free.
>
> I had been receiving them for a week or two now as well. At first, I
> thoght some spammer with a touch of forethought culled this address
> through some method. Never considered it to be a virus infected machine
> sending the emails. They have been arriving in my inbox directly, so
> whoever it is possibly has my email adderss seperately in their address
> book. That may help narrow it. I know for one it can't be me as the only
> place my BL information is stored at is lonestar.org and they're a unix
> machine :)

See below. The address of the 'sender' and recipient of the worm do not
have to be in the address book. The inbox will do.

discovered W32/Netsky.p@MM, also known as Netsky.p. Netsky.p is a
prolific worm that spreads via email, sending itself to addresses
found on the victim's machine. The worm has many of the same

>From what I read elsewhere the addresses do not need to be in the address
book, they can be taken from inboxes, etc.

functionalities as its Netsky predecessors, three of which are also
currently rated a medium risk threat. ....

Netsky.p is an Internet worm that once activated emails itself to
addresses found on the victim's machine. The worm then attempts to
copy itself to folders on drives C: through Z: and it takes advantage
the MS01-020 vulnerability announced (and patched) by Microsoft in
2001. This vulnerability allows the auto execution of files attached
in email on systems running Microsoft Internet Explorer 5.01 or 5.5
without Service Pack 2. More information and the update can be found


Anyone on our list using IE 5.0 or 5.5?

at http://www.microsoft.com/technet/security/bulletin/MS01-020.mspx.
McAfee AVERT strongly users to update their systems and also delete
any email containing the following:
From: (forged address taken from infected system)

Subject: (Taken from the following list)
* Stolen document
* Re:Hello
* Mail Delivery (failure sender address)
I also get these viruses in 'failure notice' mails sent to be my a helpful
ISP that assume I was really the sender of a mail to some address that no
longer exists, along with worm-less warnings that I sent the virus (in my
case all in Spanish or Portuguese this week, at my other address).

* Private document
* Re:Notify
* Re:document
* Re:Extended Mail System
* Re:Proctected Mail System
* Re:Question
* Private document
* Postcard

Body: (Taken from the following list)
* I found this document about you.
* I have attached it to this mail.
* Waiting for authentification.
* Please confirm!
* Protected message is available
* Do not visit this illegal websites!
* Here is my phone number.
* I cannot believe that.
* Your file is attached.
* For further details see that attachment.
* Congratulations!, your best friend.
* Greetings from france, your friend.
* If the message will not displayed automatically, follow the link
to read the delivered message.
Received message is available at:(forged web link. )

The list does not appear to be complete. The most recent one I got here
is 'Order' subject line. Another one is 'Are you a spammer?'.

Pathology
After being executed, Netsky.p emails itself out as a .ZIP attachment
with a filename taken from strings within the worm. It queries the DNS
server for the MX record and connects directly to the Mail Transfer
Agent (MTA) of the targeted domain and sends the message. The worm
then copies itself the WINDOWS directory with the filename
"FVProtect.exe." The worm adds a registry key that helps it activate
at the system start-up.
Cure
Immediate information and the cure for this virus can be found online
at the Network Associates McAfee AVERT site located at
http://vil.nai.com/vil/content/v_101119.htm. Users of McAfee Security
products should update their systems from that page. Generic
protection, which also protects users against the W32/Netsky.c@MM
variant, has been available with the 4340 or later scanning engine to
stop potential damage.
Network Associates McAfee(R) Protection-in-Depth(TM) Strategy delivers
the industry's only complete set of system and network protection
..........
1. http://www.networkassociates.com/us/index.asp





Archive powered by MHonArc 2.6.24.

Top of Page