| ALIAS: | Baba, W32/NetSky.AG@mm, W32/NetSky.AH@mm |
| SIZE: | 30752 |
| ORIGIN: | South Korea |
From: randomaddress@somewhere.com To: bob@acme.com Subject: Mail Delivery failure - bob@acme.com
If the message will not displayed automatically, . you cancheck original in attached message.txt www.acme.com/inbox/security/read.asp?sessionid-5339
Attachment: "message.txt mcafee.com"W32/Buchon@mm searches local drives for e-mail addresses. Files with following extensions are scanned for e-mail addresses:
.dbx .wab .mbx .eml .mdb .tbbThe worm also drops a keylogger.
Write-up: Mikko Hypponen, October 21st, 2004. Updated: Ero Carrera, October 22nd, 2004. F-Secure Corporation