The Message Body is randomly composed from an even more extensive list of options. A complete list of possible message bodies may be found in Symantec's description of the worm.
The attachment will be randomly named, using the extensions previously discussed on page one. The name of the attachment will be selected from the following: document, associal, msg, yours, doc, wife, talk, message, response, creditcard, description, details, attachment, pic, me, trash, card, stuff, poster, posting, portmoney, textfile, moonlight, concert, sexy, information, news, note, number_phone, bill, mydate, swimmingpool, class_photos, product, old_photos, topseller, ps, important, shower, myaunt, aboutyou, yours, nomoney, birth, found, death, story, worker, mails, letter, more, website, regards, regid, friend, unfolds, jokes, doc_ang, your_stuff, location, 454543403, final, schock, release, webcam, dinner, intimate stuff, sexual, ranking, object, secrets, mail2, attach2, part2, msg2, disco, freaky, visa, party, material, misc, nothing, transfer, auction, warez, undefinied, violence, update, masturbation, injection, naked1, naked2, tear, music, paypal, id, privacy, word_doc, image, or incest.
Netsky will also drop randomly named ZIP files into the Windows directory, using the same list of options used for the attachment names.
Also see: Netsky.B worm
