W32/Netsky.AN Worm

 Information about the W32/Netsky.AN Worm:

W32/Netsky.AN is an email worm. This worm is a variant of W32/Netsky. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address, picked up from the infected system.

The subject of the infected email will be any one of the following;

Re: important
its me
you?
notification denied!
Yep Re: does it
what's up?
Re: unknown dear
warning fake?
stolen
Re: excuse me
Status
report
Re: {5664ddff?$??º2}
something for you
Re: information
private?
Re: hi
last chance!
Re: hello
question
Re: Re: Re: Re: re: take it error
notice!
moin
I'm back!
hi read it immediatelly
goodmorning
lol
Re: hey exception
info
important
Delivery Failed
illegal...
hey trust me
believe me
Here is it
hello

The body of the email will be any one of the following;

is that possible?
yours?
pages?
your TAN number?
(Failure)
your photo is poor
are you the naked one?
your personal record?
thats wrong!
your name is wrong!
your job? (I found that!)
the truth?
your icq number?
xxx about you?
your hero in the picture?
are you a teacherin the picture?
your face?
your document is silly!
why should I?
your design is not good!
solve the problem!
your body?
see this!
Your bill.
your attachment? verify it.
your are naked?
your account is expired!
you won the rk!
you look like an rat?
you have tried to steal!
what?
you have done a mistake in the document"..
money?
you have a sexy body in the pic!
Antispam is turned off. See file!
you earn money, see the attachment!
you cannot hide yourself! (see photo)
your lie is going around the world!
you are sexy in this doc!
you are naked in this document!
(Antispam complete)
You are infected. Read the details!
you are bad
you are a bad writer
yes.
xxx service
xxx ?
wrong calculation! (see the attachment!"..
why?
who?
what still?
what means that?
Virus CIH1003 encontrado !!!!!!
this is an attachment message!
Varroa Pugao!!!
try this patch!
trial?
you look like an ape!
Transaction failed. Show the doc!
time to fear?
this file is bad!
something about you!
the information is wrong!
what do you think about it?
that's a funny text.
your lie is going around the world!
test it
see your name!
take it easy!
such as yours?
this is nothing for kids!
stuff about you?
something is going wrong!
that is interesting...
something is going ...
schoolfriend?
reply
really?
read the details.
read it immediately!
pwd?
pretty pic about you?
presente de nata abra agora
poor quality!
picture?
personal message!
you feel the same.
only encrypted!
old photos about you?
ok...
new patch is available!
never!
is that your slip?
nao saia de casa sem guarda chuva! Te a"..
is that your photo?
my advice....
msg
modifications?
misc. and so on. see you!
Microsoft
message?
meaning of that?
man or women?
love letter?
Login required! Read the attachment!
lets talk about it!
let it!
kill the writer of this document!
its private from me
it's a secret!
here is yours!
is this information about you?
is the pic a fake?
it's so similar as yours!
is that yours?
kill him on the picture!
is that your privacy?
is that your work?
possible?
is that your wife?
here is my advice.
is that your website?
is that your TAN?
i need you!
is that your porn pic?
do you know the thief?
is that your name?
is that your message?
is that your finger?
is that your family?
illegal st. of you?
is that your domain?
i want more...
is that your creditcard?
is that your cd?
important?
is that your car?
is that your beast?
I wait for an answer!
(bad gateway)
is that your attachment?
i saw you last week!
is that your account?
(Failed message available)
instruct me about this!
is that true?
incest?
is that the reality?
i wait for your comment about it.
is that criminal?
here is it.
i hope thats not true!
in your mind?
great xxx!
i've found it about you
i lost that
information about you?
i like your doc!
i know your document!
bob the builder
i have received this.
i found this document about you.
here is my photo!
i found that about you!
I have your password!
here is the next one!
i don't want your xxx pics!
here, the serials
(Server Error)
i don't think so.
here, the introduction
I don't know your document!
here, the cheats
i am speachless about your document!
here is the document.
i am desperate
here is the (censored)
gonna?
I 've found your bill!
docs?
her.
do you know this????
help attached
greetings
from the chatter (my photo!)
great!
great job!
File is bad.
here is the $%%454$
how?
good work!
from your lover ;-)
forgotten?
another pic, have fun! ... :->
File is self-decryting.
(Message Error)
File is damaged.
(Mail failed)
feel free to use it.
fast food...
explique
(Deliver Error)
excellent!
drugs? ...
does it matter?
(Attachment Signature 34933920)
does it match?
doc?
doc about me?
(Attachment from Poland)
do you think so?
are you a photographer?
do you have?
your eyes?
do you have sex in the picture?
abuse?
do you have an orgasm in the picture?
(Transfer complete)
do not use this creditcard!
account?
do not use my document!
(scanned by norton antivirus)
do not show this anyone!
do not give up!
Diga sobre o que voce que isso!!!
child porn?
did you sent it to me?
(Automailer)
did you see her already?
are you cranky?
did you know that?
classroom test of you?
did you know from this document?
copyright?
did you ask me for that?
already?
correct it!
child or adult?
best?
Authentification required. Read the att"..
attachi#
are you the one?
(Warning from the Government)
be mad?
are you the naked person!
a crazy doc about you
(null)
(Click the attachment to decrypt)
does it belong to you?
(Attached Msg)
something is not ok
your document is not good
do you have the bug also?

The infected email has an attachment with any one of the following names;

your_stuff
warez
yours
worker
more
word_doc
454543403
wife
website
visa
update
unfolds
violence
undefinied
trash
aboutyou
textfile
talk
swimmingpool
stuff
story
shower
tear
sexual
secrets
response
message
regid
regards
doc
ranking
ps
product
auction
privacy
topseller
poster
release
portmoney
pic
paypal
attach2
party
sexy
part2
old_photos
object
number_phone
music
nothing
note
news
msg2
naked2
schock
naked1
mydate
nomoney
myaunt
webcam
msg
death
moonlight
me
material
birth
masturbation
information
mails
class_photos
mail2
location
letter
jokes
intimate stuff
document
injection
incest
important
image
id
friend
description
freaky
concert
found
final
doc_ang
disco
creditcard
dinner
associal
details
posting
card
misc
bill
transfer

The file extension of the infected attachment will be single or double extension with a combination of the following extensions;

.rtf, .txt, .doc, .htm, .exe, .scr, .com, .pif and .zip.

Upon execution of the infected attachment, the worm copies itself as McAffeAv.exe in the Windows folder.

The worm modifies registry at the following location to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system and shared folders;

.php, .pl, .rtf, .sht, .tbb, .txt, .uin, .vbs, .wab, .adb, .asp, .dbx, .doc, .eml, .htm, .html, .msg and .oft.

After this, the worm mails itself to these addresses using its own SMTP engine.

The worm may de-activate some variants of W32/Mydoom and W32/Netsky in the infected system.

This worm first appeared on September 26, 2005.

 Other names of W32/Netsky.AN Worm:

This Worm is also known as WORM_NETSKY.AL, W32.Netsky.AN@mm.