W32.Netsky.E@mm

[Devilfrank]

W32.Netsky.E is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. This worm also searches drives C through Y for folders that have names containing "Shar," and then copies itself to those folders.

The Subject, Body, and Attachment vary.




--------------------------------------------------------------------------------
Notes:
Virus definitions with the version number 60301p (extended version 03/01/2004 rev 16) and later are required to detect this variant.
LiveUpdate virus definitions with version 60301v (extended version 03/01/2004 rev 22) detect this variant.
Symantec Security Response has developed a removal tool to clean the infections of W32.Netsky.E@mm.

--------------------------------------------------------------------------------


Also Known As: Win32.Netsky.E [Computer Associates], W32/Netsky.e@MM [McAfee], W32/Netsky-E [Sophos], WORM_NETSKY.E [Trend], I-Worm.Netsky.e [Kaspersky]

Type: Worm
Infection Length: 24,840 bytes



Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x

http://www.symantec.com/avcenter/venc/data/[email protected]