http://securityresponse.symantec.com...tsky.p@mm.html
---
W32.Netsky.P@mm (also known as W32.Netsky.Q@mm) is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. The worm also tries to spread through various file-sharing programs by copying itself into various shared folders.
The From line of the email is spoofed, and its Subject line and message body of the email vary. The attachment name varies with the .exe, .pif, .scr, or .zip file extension.
The worm uses the
Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability to cause unpatched systems to auto-execute the worm when reading or previewing an infected message.
This threat is compressed with FSG.
---
also
http://www.trendmicro.com/vinfo/viru...=WORM_NETSKY.P
----
it basically looks like it just re-sends itself thru email..doesnt look like it does destructive things
----
Have you done all of your windows updates??
---
I also noticed this
It deletes several autorun registry entries in an attempt to prevent the automatic execution of BAGLE, NACHI, MYDOOM and DEADHAT worms. It also deletes certain registry keys.
lol..what is with that...I have seen this a few times lately...where the virus will try to disable other viruses....sort of funny..is that a competition thing or something between virus writers?
JP
Script-kiddies, what can I say.
Linear Mode
