New NetSky variant reported - Computerworld

New NetSky variant reported - Computerworld
(IDG NEWS SERVICE) - A new version of the NetSky e-mail worm has begun circulating on the Internet, antivirus software companies reported.

Like its predecessor, NetsSky.B, which struck last week, the worm, known as NetSky.C, arrives via e-mail messages with familiar subject lines like "Question," "Fwd: lol" and "Re: hey." Users launch the worm by clicking on attachments accompanying the messages.


"They're keeping subject messages really simple, which entices users to click on the attachment," said Steven Sundermeier, the vice president of products and services at Central Command Inc., a security software vendor in Medina, Ohio. "You could see how that kind of piques users' curiosity."

Once launched, the worm installs its own mail server on the user's computer and begins sending infected e-mail using addresses it collects from the infected computer.


*Read my email Tips...

The worm also appears to target users of file-sharing services, said Sundermeier. "If it finds any subdirectory that has the word shar in its name, it will drop a long list of enticing file names in it, which are copies of itself," Sundermeier said. "That now makes it available through file-sharing applications like Kazaa or instant messaging applications."