Name:
I-Worm.Netsky.d
In Umlauf seit:
01.03.2004
Absenderangabe:
unterschiedlich, gefälscht!
Betreff/Subject:
Eines der folgenden

* Your file is attached.
* Please read the attached file.
* Please have a look at the attached file.
* See the attached file for details.
* Here is the file.
* Your document is attached.
* Re: Your website
* Re: Your product
* Re: Your letter
* Re: Your archive
* Re: Your text
* Re: Your bill
* Re: Your details
* Re: My details
* Re: Word file
* Re: Excel file
* Re: Details
* Re: Approved
* Re: Your software
* Re: Your music
* Re: Here
* Re: Re: Re: Your document
* Re: Hello
* Re: Hi
* Re: Re: Message
* Re: Your picture
* Re: Here is the document
* Re: Your document
* Re: Thanks!
* Re: Re: Thanks!
* Re: Re: Document
* Re: Document
Nachricht:
eines davon:
Your document is attached.
Here is the file.
See the attached file for details.
Please have a look at the attached file
Please read the attached file.
Your file is attached.
Anhang:
* your_website.pif
* your_product.pif
* your_letter.pif
* your_archive.pif
* your_text.pif
* your_bill.pif
* your_details.pif
* document_word.pif
* document_excel.pif
* my_details.pif
* all_document.pif
* application.pif
* mp3music.pif
* yours.pif
* document_4351.pif
* your_file.pif
* message_details.pif
* your_picture.pif
* document_full.pif
* message_part2.pif
* document.pif
* your_document.pif

Der Wurm kopiert sich als winlogon.exe nach %WinDir%.

Verbreitung:
Via eMail in Verwendung einer eigenen SMTP-engine.

Detailinformation finden Sie hier:
http://www.viruslist.com/eng/alert.html?id=1069526
http://www.symantec.com/avcenter/venc/data/w32.netsky.d@mm.html
http://vil.nai.com/vil/content/v_101064.htm
http://www.sophos.com/virusinfo/analyses/w32netskyd.html
http://www.symantec.com/avcenter/venc/data/w32.netsky.d@mm.html

Gegenmittel:

Gibts derzeit bei:
http://www.symantec.com/avcenter/tools.list.html
http://vil.nai.com/vil/averttools.asp