Netsky.b worm spreading fast
Security experts have warned of a new mass mailer worm, W32/Netsky.b@MM or Netsky.b.
Anti-virus software vendor McAfee’s Anti-Virus Emergency Response Team (Avert) said the worm’s infection rate had reached 40-50 PCs an hour.
A memory resident mass mailer, the worm copies itself to folders on drives ‘C:-Z:’ including the words ‘shared’ or ‘sharing,’ presumably to achieve P2P propagation.
After being executed, the worm emails itself out as an attachment with a randomly chosen filename.
Avert added that they believe the worm may attempt to clean up the MyDoom backdoor by deleting the registry keys that load it at the system start-up.
The attachment may have a double-extension such as .rtf.pif and may be contained in a .ZIP file.
The email includes a variety of messages including ‘I have your password!’, ‘about me’, ‘anything ok?’ and ‘do you?’