CAN20040218c
Netsky.B Worm On The Loose

New Worm Replicates to Shared Drives, Overloads E-mail

Dates & Revisions

• Original CAN date: February 18, 2004
• Latest revision: February 18, 2004

Systems Affected

Problem Overview

A new worm known as Netsky.B has been discovered in heavy distribution on the Internet. The worm propogates by e-mail, arriving as a randomly-named document (see Symantec bulletin below). Once opened/executed, the worm copies itself to various locations on the infected computer's hard drive, copies itself to any shared drives which contain the words "Share" or "Sharing" in their share names, changes various registry entries, and attempts to send itself to every e-mail address it can locate on the infected computer.

While infection by this worm may make your computer unstable, the more likely damage will be caused by loss of bandwidth due to the heavy amounts of e-mail this worm generates.

Problem Details

For detailed technical descriptions of the problem, please review the following links:

• Symantec Security Response Overview
• ComputerWorld article re:Netsky.B worm

Please note that the organizations controlling the content of the web sites referenced by these links may periodically update the information on their sites as new details about the severity of the threat become known.

What Should I Do?

You should immediately:

• review the bulletins listed above and
• delete any such e-mail which you receive without opening the attachment, and
• remove any unnecessary network shares from your computer, and
• update your anti-virus software with the latest available signature files.

What If I Am Unable To Fix The Problem?

If you are unable to correct these problems yourself or are unsure how to proceed, contact Logical Operators by clicking here and arrange to have one of our service technicians check your system and apply the corrections for you (standard service fees will apply). In addition to correcting the problem(s) listed in this CAN, our technicians can also test your system for thousands of other known threats which may be present on your system, make valuable recommendations on securing your system from future threats, and perform numerous other computing services.