Baslinux mailing list

[Sindi Keesan <keesan AT iamjlamb.com>]

On Fri, 30 Apr 2004, Matrix Mole wrote:

> On Thu, 29 Apr 2004, Sindi Keesan wrote:
> 
> > Would any users of Windows mail programs on this list please check for the
> > netsky.b virus?  You can read about it online and look for a particular
> > filename in your computer.   DOS users can download f-prot antivirus
> > software and use it free.
> 
> I had been receiving them for a week or two now as well. At first, I
> thoght some spammer with a touch of forethought culled this address
> through some method. Never considered it to be a virus infected machine
> sending the emails. They have been arriving in my inbox directly, so
> whoever it is possibly has my email adderss seperately in their address
> book. That may help narrow it. I know for one it can't be me as the only
> place my BL information is stored at is lonestar.org and they're a unix
> machine :)

See below.  The address of the 'sender' and recipient of the worm do not 
have to be in the address book.  The inbox will do.

   discovered W32/Netsky.p@MM, also known as Netsky.p. Netsky.p is a
   prolific worm that spreads via email, sending itself to addresses
   found on the victim's machine. The worm has many of the same

>From what I read elsewhere the addresses do not need to be in the address 
book, they can be taken from inboxes, etc.

   functionalities as its Netsky predecessors, three of which are also
   currently rated a medium risk threat. ....

   Netsky.p is an Internet worm that once activated emails itself to
   addresses found on the victim's machine. The worm then attempts to
   copy itself to folders on drives C: through Z: and it takes advantage
   the MS01-020 vulnerability announced (and patched) by Microsoft in
   2001. This vulnerability allows the auto execution of files attached
   in email on systems running Microsoft Internet Explorer 5.01 or 5.5
   without Service Pack 2. More information and the update can be found


Anyone on our list using IE 5.0 or 5.5?

   at http://www.microsoft.com/technet/security/bulletin/MS01-020.mspx.
   McAfee AVERT strongly users to update their systems and also delete
   any email containing the following:
   From: (forged address taken from infected system)

   Subject: (Taken from the following list)
     * Stolen document
     * Re:Hello
     * Mail Delivery (failure sender address)
I also get these viruses in 'failure notice' mails sent to be my a helpful 
ISP that assume I was really the sender of a mail to some address that no 
longer exists, along with worm-less warnings that I sent the virus (in my 
case all in Spanish or Portuguese this week, at my other address).

     * Private document
     * Re:Notify
     * Re:document
     * Re:Extended Mail System
     * Re:Proctected Mail System
     * Re:Question
     * Private document
     * Postcard

   Body: (Taken from the following list)
     * I found this document about you.
     * I have attached it to this mail.
     * Waiting for authentification.
     * Please confirm!
     * Protected message is available
     * Do not visit this illegal websites!
     * Here is my phone number.
     * I cannot believe that.
     * Your file is attached.
     * For further details see that attachment.
     * Congratulations!, your best friend.
     * Greetings from france, your friend.
     * If the message will not displayed automatically, follow the link
       to read the delivered message.
       Received message is available at:(forged web link. )

The list does not appear to be complete.  The most recent one I got here 
is 'Order' subject line.  Another one is 'Are you a spammer?'.

   Pathology
   After being executed, Netsky.p emails itself out as a .ZIP attachment
   with a filename taken from strings within the worm. It queries the DNS
   server for the MX record and connects directly to the Mail Transfer
   Agent (MTA) of the targeted domain and sends the message. The worm
   then copies itself the WINDOWS directory with the filename
   "FVProtect.exe." The worm adds a registry key that helps it activate
   at the system start-up.
   Cure
   Immediate information and the cure for this virus can be found online
   at the Network Associates McAfee AVERT site located at
   http://vil.nai.com/vil/content/v_101119.htm. Users of McAfee Security
   products should update their systems from that page. Generic
   protection, which also protects users against the W32/Netsky.c@MM
   variant, has been available with the 4340 or later scanning engine to
   stop potential damage.
   Network Associates McAfee(R) Protection-in-Depth(TM) Strategy delivers
   the industry's only complete set of system and network protection
..........
   1. http://www.networkassociates.com/us/index.asp