|
|
|
|
| Enciclopedia de virus |  |
Alertas | |
Análisis | |
Noticias | |
Glosario |
 |
| ||||||
|
| ||||||
|
| ||||||||||
| ||||||||
Home / Virus / Enciclopedia de virus
Email-Worm.Win32.NetSky.qOtras versiones: .aa, .b, .t, .x, .y
Este gusano se propaga a través de Internet como un archivo adjunto a los mensajes infectados. También puede propagarse a traves de redes P2P y directorios http y ftp accesibles. El componente principal del gusano es un archivo PE EXE de aproximadamente 29KB. El gusano se empaqueta usando FSG; el archivo sin empaquetar es de aproximadamente 40KB de tamaño. InstalaciónEl gusano se copia al directorio de Windows bajo el nombre fvprotect.exe y registra este archivo en los códigos de registrosla sección de autoejecución del sistema: [ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Norton Antivirus AV" = %windir\fvprotect.exe El gusano también crea un archivo llamado userconfig9x.dll el el directorio de Windows, y otros archivos con los siguientes nombres: zipped.tmp base64.tmp zip1.tmp zip2.tmp zip3.tmp Estos archivos son copias del gusano en formato UEE y archivos ZIP que contienen copias del gusano. Los archivos dentro del archivo ZIP tendrán nombres elegidos de la siguiente lista: document.txt.exe data.rtf.scr details.txt.pif El gusano crea un mutex (candado), ""_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_", para señalar su presencia en el sistema. Propagación por correo-ecorreo electrónicoEl gusano busca archivos con cualquiera de las siguientes extensiones: .eml .txt .php .asp .wab .doc .vbs .rtf .uin .shtm .cgi .dhtm .pl .htm .html .adb .tbb .dbx .sht .oft .msg .jsp .wsh .xml y envía copias de sí mismo a las direcciones de correo electrónico recolectadas de estos archivos. El gusano usa su propia biblioteca SMPT para enviar mensajes. El gusano también intenta establecer una conexión directa con el servidor del receptor destinatario del mensaje. Mensajes Infectados:Los mensajes infectados contienen combinaciones al azar de las opciones listadas debajo: Dirección del emisor:Elegida al azar de aquellas recolectadas por el equipo infectado. Asunto del mensaje:Re: Hi Re: Hello Re: Encrypted Mail Re: Extended Mail Re: Status Re: Notify Re: SMTP Server Re: Mail Server Re: Delivery Server Re: Request Re: Bad Request Re: Failure Re: Thank you for delivery Re: Test Re: Administration Re: Message Error Re: Error Re: Extended Mail System Re: Secure SMTP Message Re: Protected Mail Request Re: Protected Mail System Re: Protected Mail Delivery Re: Secure delivery Re: Delivery Protection Re: Mail Authentification Re: List Re: Question Re: Proof of concept Re: Developement Re: Message Re: Error in document Re: Free porn Re: Sex pictures Re: Submit a Virus Sample Re: Virus Sample Re: Old times Re: Old photos Re: Sample Re: Its me Re: Is that your document? Re: Approved document Re: Your document Protected Mail System Mail Authentication Is that your password? Private document Stolen document Mail Account Administrator Illegal Website Internet Provider Abuse Thank you! Congratulations! Postcard Your day Mail Delivery Error Shocking document You cannot do that! hi hello Fwd: Warning again Notice again Spamed? Spam 0i09u5rug08r89589gjrg Re: A!p$ghsa Important m$6h?3p Do you? Does it matter? News Information I love you! I cannot forget you! here your my thanks! approved corrected patched improved important read it immediately o una lista de caracteres al azar Cuerpo del mensaje:Please see the attached file for details Please read the attached file! Your document is attached. Please read the document. Your file is attached. Your document is attached. Please confirm the document. Please read the important document. See the file. Requested file. Authentication required. Your document is attached to this mail. I have attached your document. I have received your document. The corrected document is attached. Your document. Your details. Please confirm! Please answer quickly! Thank you for your request, your details are attached! Thanks! am shocked about your document! Let'us be short: you have no experience in writing letters!!! Try this, or nothing! Here is it! Do not visit this illegal websites! You have downloaded these illegal cracks? Here is my icq list. Here is my phone number. I have visited this website and I found you in the spammer list. Is that true? Are you a spammer? (I found your email on a spammer website!?!) po44u90ugjid-k9z5894z0 9u049u89gh89fsdpokofkdpbm3-4i Please r564g!he4a56a3haafdogu#mfn3o SMTP Error #201 See the ghg5%&6gfz65!4Hf55d!46gfgf Server Error #203 Your photo, uahhh.... , you are naked! You have written a very good text, excellent, good work! Your archive is attached. Monthly news report. lovely, :-) your big love, ;-) I hope you accept the result! The sample is attached! Your important document, correction is finished! Important message, do not show this anyone! Here is the website. ;-) My favourite page. I have corrected your document. I have attached the sample. Your bill is attached to this mail. You were registered to the pay system. For more details see the attachment. Binary message is available. Message has been sent as a binary attachment. Can you confirm it? I have attached it to this mail. Please read the attached file. Your document is attached. Encrypted message is available. Protected message is attached. Please confirm my request. ESMTP [Secure Mail System #334]: Secure message is attached. Partial message is available. Waiting for a Response. Please read the attachment. First part of the secure mail is available. For more details see the attachment. For further details see the attachment. Your requested mail has been attached. Protected Mail System Test. Secure Mail System Beta Test. Forwarded message is available. Delivered message is attached. Encrypted message is available. Please read the attachment to get the message. Follow the instructions to read the message. Please authenticate the secure message. Protected message is attached. Waiting for authentification. Protected message is available. Bad Gateway: The message has been attached. SMTP: Please confirm the attached message. You got a new message. Now a new message is available. New message is available. You have received an extended message. Please read the instructions. I noticed that you have visited illegal websites. See the name in the list! You have visited illegal websites. I have a big list of the websites you surfed. Your mail account is expired. See the details to reactivate it. Your mail account has been closed. For further details see the document. The file is protected with the password ghj001. I have attached your file. Your password is jkl44563. The sample file you sent contains a new virus version of mydoom.j. Please clean your system with the attached signature. Sincerly, Robert Ferrew Greetings from france, your friend. Have a look at these. Best wishes, your friend. Congratulations!, your best friend. I found this document about you. I cannot believe that. Try this game ;-) I hope the patch works. Al final del mensaje podría incluirse información falsa de que el mensaje ha sido examinado y declarado limpio por un programa antivirus: +++ Attachment: No Virus found +++ MessageLabs AntiVirus - www.messagelabs.com +++ Attachment: No Virus found +++ Bitdefender AntiVirus - www.bitdefender.com +++ Attachment: No Virus found +++ MC-Afee AntiVirus - www.mcafee.com +++ Attachment: No Virus found +++ Kaspersky AntiVirus - www.kaspersky.com +++ Attachment: No Virus found +++ Panda AntiVirus - www.pandasoftware.com ++++ Attachment: No Virus found ++++ Norman AntiVirus - www.norman.com ++++ Attachment: No Virus found ++++ F-Secure AntiVirus - www.f-secure.com ++++ Attachment: No Virus found ++++ Norton AntiVirus - www.symantec.de Hay una gran variedad de posibles nombres para los archivos adjuntos. El archivo adjunto usualmente tiene una extensión doble, siendo la primera extensión .doc o .txt, y la segunda una de la lista siguiente: exe pif scr zip | ||||||||
Copyright © 1996 - 2010
Kaspersky Lab
Todos los derechos reservados
Correo electrónico: webmaster@viruslist.com
