|
|
I-Worm.NetSky. Viruses Information
| Name: |
I-Worm.NetSky. |
| Category: |
Viruses |
| Description:
|
Details
I-Worm.NetSky.d
This worm spreads via the Internet as a file attached to infected messages.
The worm is a Windows PE EXE file, of approximately 17424 bytes, written in Microsoft Visual C++. It is packed using Petite. The unpacked file is approximately 27KB in size.
Infected messages
Message header, chosen at random from the list below:
Re: Approved
Re: Details
Re: Excel file
Re: Hello
Re: Here
Re: Here is the document
Re: Hi
Re: My details
Re: Re: Document
Re: Re: Message
Re: Re: Re: Your document
Re: Re: Thanks!
Re: Thanks!
Re: Word file
Re: Your archive
Re: Your bill
Re: Your details
Re: Your document
Re: Your letter
Re: Your music
Re: Your picture
Re: Your product
Re: Your software
Re: Your text
Re: Your website
Message body, chosen at random from the list below:
Here is the file.
Please have a look at the attached file
Please read the attached file.
See the attached file for details.
Your document is attached.
Your file is attached.
Attachment name, chosen at random from the list below:
all_document.pif
application.pif
document.pif
document_4351.pif
document_excel.pif
document_full.pif
document_word.pif
message_details.pif
message_part2.pif
mp3music.pif
my_details.pif
your_archive.pif
your_bill.pif
your_details.pif
your_document.pif
your_file.pif
your_letter.pif
your_product.pif
your_text.pif
your_website.pif
yours.pif
The worm is activated only if the user executes the infected file by double clicking on the attachment. The worm then installs itself to the system, and starts propagating.
Installation
When installing, the worm copies itself to the Windows directory under the name winlogon.exe and registers this file in the system registry auto-run key:
[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
Sending messages
To harvest email addresses, the worm searches for files with the following extensions:
adb
asp
dbx
doc
eml
htm
html
msg
oft
php
pl
rtf
sht
tbb
txt
uin
vbs
wab
and sends a copy of itself to all addresses found in these files. The worm uses its own SMTP engine to send messages.
It attempts to send itself via the following SMTP servers:
145.253.2.171
151.189.13.35
193.141.40.42
193.189.244.205
193.193.144.12
193.193.158.10
194.25.2.129
194.25.2.129
194.25.2.130
194.25.2.131
194.25.2.132
194.25.2.133
194.25.2.134
195.185.185.195
195.20.224.234
212.185.252.136
212.185.252.73
212.185.253.70
212.44.160.8
212.7.128.162
212.7.128.165
213.191.74.19
217.5.97.137
62.155.255.16
Deletion of Mydoom
In a similar way to several other worms, Netsky.d is programmed to delete Mydoom from the infected machine. It searches the following branches of the system registry for the Explorer and Taskmon keys:
[HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]
[HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun]
and also deletes the following key:
[HKCRCLSID{E6FB5E20-DE35-11CF-9C87-00AA005127ED}InProcServer32]
Other
The worm deletes the keys KasperskyAv and system from the system registry. |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Antiwin_II, famil
Macro.Word97.Crypto
Win95.Spawn.4096.
TrashSoft.102
Gly.118
WhiteShark.52
Macro.Word97.Unsee
TTQ.100
Unknown1.111
NY Famil
|
|
