# MA-070.032004: MyCERT Alert - Spread of New Variants of W32.Beagle@MM and W32.Netsky@MM Worm

**Date:** 02 Mar 2004  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-070.032004  
**Advisory ID:** MA-070.032004

---

#### Introduction
MyCERT received information from various Anti-virus vendors and CERTs communities around the world regarding the wild spread of two new variants of W32.Beagle@MM and W32.Netsky@MM worms, the W32.Beagle.F@MM and the W32.Netsky.D@MM.
Information received from various sources says that the new variant of W32.Netsky.D@MM is spreading at a greater rate than any other worm in the wild at the time of the release of this alert.
*NOTE: There may be differences in naming the new variants among the AV vendors.*Systems Affected:** All Systems/PCs running on Windows Platform
### W32/Netsky.D@MM
#### Brief Description:
W32.Netsky.D@mm is a mass-mailing worm that is a variant of W32.Netsky.C@mm. The worm scans drives C through Z for email addresses and sends itself to those that are found. The Subject, Body, and Attachment names vary. The attachment will have a .pif file extension[3].
#### Discovered on:
1st March 2004 (US Pacific Time). The spread of this variant was detected on 2nd March 2004 in Malaysia.
#### Payload/Damages:
Sends a copy of itself by using a spoofed email address to email addresses retrieved from the infected file system.
#### Propagation:
This worm propagates by sending out email with the following details:
#### Subject: (any of the following)
| --- | Re: Your website  Re: Your product  Re: Your letter  Re: Your archive  Re: Your text  Re: Your bill  Re: Your details  Re: My details  Re: Word file  Re: Excel file  Re: Details  Re: Approved  Re: Your software  Re: Your music  Re: Here  Re: Re: Re: Your document  Re: Hello  Re: Hi  Re: Re: Message  Re: Your picture  Re: Here is the document  Re: Your document  Re: Thanks!  Re: Re: Thanks!  Re: Re: Document  Re: Document |
#### Message Body: (any of the following)
| --- | Your file is attached.  Please read the attached file.  Please have a look at the attached file.  See the attached file for details.  Here is the file.  Your document is attached. |
#### Attachment: (any of the following)
| --- | your\_website.pif  your\_product.pif  your\_letter.pif  your\_archive.pif  your\_text.pif  your\_bill.pif  your\_details.pif  document\_word.pif  document\_excel.pif  my\_details.pif  all\_document.pif  application.pif  mp3music.pif  yours.pif  document\_4351.pif  your\_file.pif  message\_details.pif  your\_picture.pif  document\_full.pif  message\_part2.pif  document.pif  your\_document.pif |
### W32/Beagle.F@MM
The W32.Beagle.F@MM is a mass-mailing worm that opens a backdoor on TCP port 2745. It uses its own SMTP engine for email propagation.
This variant propagates via email attachments and attempts to spread across file-sharing networks, such as Kazaa and iMesh by dropping itself into the directories that contain "shar" in their names.
#### Discovered on:
The W32.Beagle.F@MM was discovered on 29th February 2004 (US Pacific Time). The spread of this variant was detected on 1st March 2004 in Malaysia.
#### Payload/Damages:
1. Sends a copy of itself by using a spoofed email address to email addresses retrieved from the infected file system.
2. Allows unauthorized remote access via TCP port 2745.
3. Terminates processes 
#### Propagation:
This worm propagates by sending out email with the following details:
*NOTE: The worm also propagates through file sharing.*
#### Subject: Various, including:
| --- | Accounts department  Ahtung!  Camila  Daily activity report  Flayers among us  Freedom for everyone  From Hair-cutter  From me  Greet the day  Hardware devices price-list  Hello my friend  Hi!  Jenny  Jessica  for the report  Maria  Melissa  Monthly incomings summary  New Price-list  Price  Price list  Pricelist  Price-list  Proclivity to servitude  Registration confirmation  The account  The employee  The summary  USA government abolishes the capital punishment  Weekly activity report  Well...  You are dismissed  You really love me? he he |
#### Text:
No message body
#### Attachment:
Randomly named ZIP file, containing an executable disguised as an Excel file.
Consists of the name, which is randomly selected from the following list:
| --- | Aline  Anna  Audra  Bad girl  Barbi  Caitie  caroline  Gallery  It\_I  Jammie  Juli  Julie  kate  Katrina  Kelley  kleopatra  Lisa  Mandy  Mary  Mary-Anne  myfotos  Photoalbum  Photomontage  Picture  rebecca  Rena  Sara  stacy  Tammy |
The attachment name has one of the following extensions:
| --- | .exe  .scr  .zip |
### Removal
Infected PCs/Systems can be cleaned up by using an Automatic Removal tool available at the respective Anti-virus vendors' sites.
#### Mitigation
MyCERT advises users to take note of this alert to prevent any unwanted incidents 
#### MyCERT recommends:
1. System Administrators install Anti-virus filters at their organization's email gateways to block the worm attachments.
2. It is important for all users to regularly update their Anti -virus softwares. Those who do not have an Anti-virus running on their PC, may download one at:
> [https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
> )
3. Users should refrain from opening unknown/suspicious attachments. Users may refer to the following document on safe email practices at:
> Safe Email Practices:
> [https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
> )
MyCERT can be reached for further assistance at:
Tel: 03-89961901
Fax: 03-89960827
Email: [[email protected]](/cdn-cgi/l/email-protection)
https://www.mycert.org.my
### References:
1. W32.Netsky.D@mm (Symantec)
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
2. WORM\_NETSKY.D (Trend Micro)
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM\_NETSKY.D
3. W32.Beagle.F (Symantec)
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
4. AUSCERT
http://www.auscert.org.au/render.html?it=3908