W32/Netsky.Y Worm

 Information about the W32/Netsky.Y worm:

W32/Netsky.Y is a mass mailing worm. This worm is a variant of W32/Netsky.This worm infects Windows systems and spreads through email.

The infected email carries a spoofed 'From' address, picked up from the infected system.

The subject of the infected email will be;

Delivery failure notice (Variable string)

The body of the email arrives in two sets. first set will be randomly selected by the following words;

Delivered
External
New
Partial

Second set of the body will be;

message is available.

The infected email attachment will have .com extension. The file name of the infected attachment will be;
www.<variable domain name>.<variable username>.session-<variable number>

Upon execution of the infected attachment, the worm copies itself as FirewallSvr.exe in the Windows folder. The worm also creates a file F<variable string>_YOU_BAGLE.TXT in the Windows folder.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.pl, .rtf, .oft, .txt, .uin, .jsp, .tbb, .cgi, .sht, .vbs, .doc, .dbx, .asp, .adb, .php, .htm, .eml, .xml, .wab, .wsh, .msg, .html, .dhtm, .shtm

The worm mails itself to these addresses using its own SMTP engine.

It also attempts to perform a DOS attack on the following sites, if the system date is between April 28th and April 31st;

www.nibis.de
www.nedinfo.ufl.edu
www.educa.ch

This worm first appeared on April 20, 2004.

 Other names of W32/Netsky.Y Worm:

This worm is also known as WORM_NETSKY.Y, W32.Netsky.Y@mm, Netsky.Y, W32/Netsky-Y