NetSky.B Worm Gains More Traction
The mass-mailing e-mail worm, a more virulent variant of an earlier worm, is considered a medium-to-high threat as it trolls folders for e-mail targets.A new mass-mailing worm, called NetSky.B, is spreading rapidly after beginning to make the rounds of e-mail inboxes on Tuesday. NetSky.B is a variant of the NetSky.A worm identified earlier in the week, but is posing a greater risk of spreading and infecting machines, security vendors warned Wednesday. Symantec Corp. rated NetSky.B a Category 4 threat, its second-highest level, while Network Associates Inc. and F-Secure Corp. rated it as a medium threat. NetSky.B is distributed through e-mails as a ZIP archive or an executable attachment. Once opened, the worm runs a file and then displays a fake error message that reads, "The file could not be opened!"
Once infecting a machine, the worm searches for e-mail addresses and scans hard drives and mapped drives, including drives C through Z, for folder names that contain the words "share" or "sharing." It then copies itself to those folders and, when an Internet connection is present, starts spreading through ZIP archives and other attachments to e-mail.