|
|
|
|
| Virus Encyclopedia |  |
Riskware | |
Alerts | |
Analysis | |
News | |
Glossary | |
Weblog |
 |
| ||||||
|
| ||||||
|
| ||||||
| ||||||||
Home / Viruses / Virus Encyclopedia / Malware Descriptions / Network Worms / Email Worms
Email-Worm.Win32.NetSky.qOther versions: .aa, .ac, .b, .c, .d, .e, .m, .o, .r, .t, .x, .y
This worm spreads via the Internet as an attachment to infected messages. It is also able to propagate via P2P networks and accessible http and ftp directories. The worm's main component is a PE EXE file of approximately 29KB. The worm is packed using FSG; the unpacked file is approximately 40KB in size. InstallationThe worm copies itself to the Windows directory under the name fvprotect.exe and registers this file in the system registry autorun key: [ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Norton Antivirus AV" = %windir\fvprotect.exe The worm also creates a file named userconfig9x.dll in the Windows directory, and files with the following names: zipped.tmpbase64.tmp zip1.tmp zip2.tmp zip3.tmp These files are copies of the worm in UEE format and ZIP archives containing copies of the worm. Files within the archive will have names chosen from the following list: document.txt.exe data.rtf.scr details.txt.pif The worm creates a mutex, ""_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_", to flag its presence in the system. Propagation via emailThe worm searches for files with any of the following extensions: .eml .txt .php .asp .wab .doc .vbs .rtf .uin .shtm .cgi .dhtm .pl .htm .html .adb .tbb .dbx .sht .oft .msg .jsp .wsh .xml and sends copies of itself to email addresses harvested from these files. The worm uses its own SMTP library to send messages. The worm also attempts to establish a direct connection to the message recipient's server. Infected messages:Infected messages contain random combinations of the options listed below. Sender's address:Chosen at random from those harvested from the infected machine Message header:Re: Hi Re: Hello Re: Encrypted Mail Re: Extended Mail Re: Status Re: Notify Re: SMTP Server Re: Mail Server Re: Delivery Server Re: Request Re: Bad Request Re: Failure Re: Thank you for delivery Re: Test Re: Administration Re: Message Error Re: Error Re: Extended Mail System Re: Secure SMTP Message Re: Protected Mail Request Re: Protected Mail System Re: Protected Mail Delivery Re: Secure delivery Re: Delivery Protection Re: Mail Authentification Re: List Re: Question Re: Proof of concept Re: Developement Re: Message Re: Error in document Re: Free porn Re: Sex pictures Re: Submit a Virus Sample Re: Virus Sample Re: Old times Re: Old photos Re: Sample Re: Its me Re: Is that your document? Re: Approved document Re: Your document Protected Mail System Mail Authentication Is that your password? Private document Stolen document Mail Account Administrator Illegal Website Internet Provider Abuse Thank you! Congratulations! Postcard Your day Mail Delivery Error Shocking document You cannot do that! hi hello Fwd: Warning again Notice again Spamed? Spam 0i09u5rug08r89589gjrg Re: A!p$ghsa Important m$6h?3p Do you? Does it matter? News Information I love you! I cannot forget you! here your my thanks! approved corrected patched improved important read it immediately or a random string of characters Message body:Please see the attached file for details Please read the attached file! Your document is attached. Please read the document. Your file is attached. Your document is attached. Please confirm the document. Please read the important document. See the file. Requested file. Authentication required. Your document is attached to this mail. I have attached your document. I have received your document. The corrected document is attached. Your document. Your details. Please confirm! Please answer quickly! Thank you for your request, your details are attached! Thanks! am shocked about your document! Let'us be short: you have no experience in writing letters!!! Try this, or nothing! Here is it! Do not visit this illegal websites! You have downloaded these illegal cracks? Here is my icq list. Here is my phone number. I have visited this website and I found you in the spammer list. Is that true? Are you a spammer? (I found your email on a spammer website!?!) po44u90ugjid-k9z5894z0 9u049u89gh89fsdpokofkdpbm3-4i Please r564g!he4a56a3haafdogu#mfn3o SMTP Error #201 See the ghg5%&6gfz65!4Hf55d!46gfgf Server Error #203 Your photo, uahhh.... , you are naked! You have written a very good text, excellent, good work! Your archive is attached. Monthly news report. lovely, :-) your big love, ;-) I hope you accept the result! The sample is attached! Your important document, correction is finished! Important message, do not show this anyone! Here is the website. ;-) My favourite page. I have corrected your document. I have attached the sample. Your bill is attached to this mail. You were registered to the pay system. For more details see the attachment. Binary message is available. Message has been sent as a binary attachment. Can you confirm it? I have attached it to this mail. Please read the attached file. Your document is attached. Encrypted message is available. Protected message is attached. Please confirm my request. ESMTP [Secure Mail System #334]: Secure message is attached. Partial message is available. Waiting for a Response. Please read the attachment. First part of the secure mail is available. For more details see the attachment. For further details see the attachment. Your requested mail has been attached. Protected Mail System Test. Secure Mail System Beta Test. Forwarded message is available. Delivered message is attached. Encrypted message is available. Please read the attachment to get the message. Follow the instructions to read the message. Please authenticate the secure message. Protected message is attached. Waiting for authentification. Protected message is available. Bad Gateway: The message has been attached. SMTP: Please confirm the attached message. You got a new message. Now a new message is available. New message is available. You have received an extended message. Please read the instructions. I noticed that you have visited illegal websites. See the name in the list! You have visited illegal websites. I have a big list of the websites you surfed. Your mail account is expired. See the details to reactivate it. Your mail account has been closed. For further details see the document. The file is protected with the password ghj001. I have attached your file. Your password is jkl44563. The sample file you sent contains a new virus version of mydoom.j. Please clean your system with the attached signature. Sincerly, Robert Ferrew Greetings from france, your friend. Have a look at these. Best wishes, your friend. Congratulations!, your best friend. I found this document about you. I cannot believe that. Try this game ;-) I hope the patch works. The end of the message may include the false information that the message has been scanned and flagged as clear by an antivirus product: +++ Attachment: No Virus found +++ MessageLabs AntiVirus - www.messagelabs.com +++ Attachment: No Virus found +++ Bitdefender AntiVirus - www.bitdefender.com +++ Attachment: No Virus found +++ MC-Afee AntiVirus - www.mcafee.com +++ Attachment: No Virus found +++ Kaspersky AntiVirus - www.kaspersky.com +++ Attachment: No Virus found +++ Panda AntiVirus - www.pandasoftware.com ++++ Attachment: No Virus found ++++ Norman AntiVirus - www.norman.com ++++ Attachment: No Virus found ++++ F-Secure AntiVirus - www.f-secure.com ++++ Attachment: No Virus found ++++ Norton AntiVirus - www.symantec.de There is a wide range of potential attachment names. The attached file often has a dual extension, with the first extension being .doc or .txt, and the second being one from the following list: exe pif scr zip The worm is also able to send itself as a ZIP archive. The worm does not send itself to addresses which contain any of the following: @antivi @avp @bitdefender @fbi @f-pro @freeav @f-secur @kaspersky @mcafee @messagel @microsof @norman @norton @pandasof @skynet @sophos @spam @symantec @viruslis abuse@ noreply@ ntivir reports@ spam@ The worm may send messages which contain the IFRAME Exploit, in the same way that Klez.h and Swen did. When this happens, if the message is viewed using a vulnerable mail client, the archive file containing the worm will be launched automatically. Propagation via P2PThe worm creates multiple copies of itself in all subdirectories which contain any of the words from the following list: bear donkey download ftp htdocs http icq kazaa lime morpheus mule my shared folder shar shared files upload Files created by the worm will have names chosen from the following list: Kazaa Lite 4.0 new.exe Britney Spears Sexy archive.doc.exe Kazaa new.exe Britney Spears porn.jpg.exe Harry Potter all e.book.doc.exe Britney sex xxx.jpg.exe Harry Potter 1-6 book.txt.exe Britney Spears blowjob.jpg.exe Harry Potter e book.doc.exe Britney Spears cumshot.jpg.exe Harry Potter.doc.exe Britney Spears fuck.jpg.exe Harry Potter game.exe Britney Spears.jpg.exe Harry Potter 5.mpg.exe Britney Spears and Eminem porn.jpg.exe Matrix.mpg.exe Britney Spears Song text archive.doc.exe Britney Spears full album.mp3.exe Eminem.mp3.exe Britney Spears.mp3.exe Eminem Song text archive.doc.exe Eminem Sexy archive.doc.exe Eminem full album.mp3.exe Eminem Spears porn.jpg.exe Ringtones.mp3.exe Eminem sex xxx.jpg.exe Ringtones.doc.exe Eminem blowjob.jpg.exe Altkins Diet.doc.exe Eminem Poster.jpg.exe American Idol.doc.exe Cloning.doc.exe Saddam Hussein.jpg.exe Arnold Schwarzenegger.jpg.exe Windows 2003 crack.exe Windows XP crack.exe Adobe Photoshop 10 crack.exe Microsoft WinXP Crack full.exe Teen Porn 15.jpg.pif Adobe Premiere 10.exe Adobe Photoshop 10 full.exe Best Matrix Screensaver new.scr Porno Screensaver britney.scr Dark Angels new.pif XXX hardcore pics.jpg.exe Microsoft Office 2003 Crack best.exe Serials edition.txt.exe Screensaver2.scr Full album all.mp3.pif Ahead Nero 8.exe netsky source code.scr E-Book Archive2.rtf.exe Doom 3 release 2.exe How to hack new.doc.exe Learn Programming 2004.doc.exe WinXP eBook newest.doc.exe Win Longhorn re.exe Dictionary English 2004 - France.doc.exe RFC compilation.doc.exe 1001 Sex and more.rtf.exe 3D Studio Max 6 3dsmax.exe Keygen 4 all new.exe Windows 2000 Sourcecode.doc.exe Norton Antivirus 2005 beta.exe Gimp 1.8 Full with Key.exe Partitionsmagic 10 beta.exe Star Office 9.exe Magix Video Deluxe 5 beta.exe Clone DVD 6.exe MS Service Pack 6.exe ACDSee 10.exe Visual Studio Net Crack all.exe Cracks & Warez Archiv.exe WinAmp 13 full.exe DivX 8.0 final.exe Opera 11.exe Internet Explorer 9 setup.exe Smashing the stack full.rtf.exe Ulead Keygen 2004.exe Lightwave 9 Update.exe The Sims 4 beta.exe OtherIf the worm finds the keys listed below in the system registry key[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]it will delete them. Explorer system. msgsvr32 winupd.exe direct.exe jijbl service Sentry au.exe direct.exe d3dupdate.exe OLE gouday.exe rate.exe Taskmon Windows Services Host sysmon.exe srate.exe ssate.exe winupd.exeIt will also delete the keys system. Videofrom HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesand the following key values, created by I-Worm.Bagle. HKLM\SYSTEM\CurrentControlSet\Services\WksPatch
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\PINF
HKCR\CLSID\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
| ||||||||
Copyright © 1996 - 2010
Kaspersky Lab
Industry-leading Antivirus Software
All rights reserved
Email: webmaster@viruslist.com
