Internet threat level: 1
Home→Descriptions→Email-Worm.Win32.NetSky.b
Email-Worm.Win32.NetSky.b
| Detected | Feb 19 2004 19:12 GMT |
| Released | Feb 19 2004 19:12 GMT |
| Published | Feb 18 2004 11:24 GMT |
Technical Details
(Also known as Moodown.b) This worm spreads via the Internet as a file attached to infected emails. The worm itself is a PE EXE file of approximately 21KB, compressed using UPX. The size of the decompressed file is approximately 40KB.Installation
Once launched, the worm displays a false error message on the screen: 'The file could not be opened'.
The worm copies itself to the Windows directory under the name 'services.exe' and registers this file in the system registry auto-run key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "service" = "%windir%\services.exe -serv"The worm also creates the unique identifier 'AdmSkynetJklS003' to flag its presence in memory.
The worm creates a number of copies of itself in all sub-directories on disks c to Z which contain the word 'share' or 'sharing' in the directory name. The copies will be under names chosen from the following list:
winxp_crack.exe dolly_buster.jpg.pif strippoker.exe photoshop 9 crack.exe matrix.scr porno.scr angels.pif hardcore porn.jpg.exe office_crack.exe serial.txt.exe cool screensaver.scr eminem - lick my pussy.mp3.pif nero.7.exe virii.scr e-book.archive.doc.exe max payne 2.crack.exe how to hack.doc.exe programming basics.doc.exe e.book.doc.exe win longhorn.doc.exe dictionary.doc.exe rfc compilation.doc.exe sex sex sex sex.doc.exe doom2.doc.pifIt also makes a number of copies in ZIP format, with names chosen from the following list:
document msg doc talk message creditcard details attachment me stuff posting textfile concert information note bill swimmingpool product topseller ps shower aboutyou nomoney found story mails website friend jokes location final release dinner ranking object mail2 part2 disco party misc #n#o#t#n#e#t#s#k#y#-#s#k#y#n#e#t#!
Propagation
The worm finds files with extensions adb, asp, dbx, doc, eml, htm, html, msg, oft, php, pl, rtf, sht, tbb, txt, uin, vbs and wab, searches them for email addresses and sends a copy of itself to the addresses found. The worm uses its own SMTP library to send messages.Infected messages have message headers and subject text chosen at random from the following list:
Message header:
Hi hi hello read it immediately something for you warning information stolen fake unknown
Message body:
AnythingOk? anything ok? what does it mean? ok i'm waiting read the details. here is the document. read it immediately! my hero here is that true? is that your name? is that your account? i wait for a reply! is that from you? you are a bad writer I have your password! something about you! kill the writer of this document! i hope it is not true! your name is wrong i found this document about you yes, really? that is bad here it is see you greetings stuff about you? something is going wrong! information about you about me from the chatter here, the serials here, the introduction here, the cheats that's funny do you? reply take it easy why? thats wrong misc you earn money you feel the same you try to steal you are bad something is going wrong something is fool
Deletion of the Mydoom worm
Moodown.b is similar to some others in that it contains a function which deletes Mydoom from machines infected by this worm. To do this, it finds the 'Explorer' and 'Taskmon' keys in the following branches:[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]also deletes the following key:
[HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]
Other
The worm deletes the 'KasperskyAv' and 'system.' keys from the Windows registry.
Email-Worms spread via email. The worm sends a copy of itself as an attachment to an email message or a link to its file on a network resource (e.g. a URL to an infected file on a compromised website or a hacker-owned website).
In the first case, the worm code activates when the infected attachment is opened (launched). In the second case, the code is activated when the link to the infected file is opened. In both case, the result is the same: the worm code is activated.
Email-Worms use a range of methods to send infected emails. The most common are:
- using a direct connection to a SMTP server using the email directory built into the worm’s code
- using MS Outlook services
- using Windows MAPI functions.
Email-Worms use a number of different sources to find email addresses to which infected emails will be sent:
- the address book in MS Outlook
- a WAB address database
- .txt files stored on the hard drive: the worm can identify which strings in text files are email addresses
- emails in the inbox (some Email-Worms even “reply” to emails found in the inbox)
Many Email-Worms use more than one of the sources listed above. There are also other sources of email addresses, such as address books associated with web-based email services.
Email-Worm.
- I-Worm.
NetSky. b (Kaspersky Lab) - I-Worm.
Moodown. b (Kaspersky Lab) - Virus:
W32/Netsky. b@MM (McAfee) - Virus:
W32/Netsky. b@MM!zip (McAfee) - Virus:
W32/Netsky. b. eml!zip (McAfee) - W32/Netsky-B (Sophos)
- Worm.
SomeFool. Gen-2 (ClamAV) - W32/Netsky.
B. dam. worm (Panda) - W32/Netsky.
B@mm (FPROT) - Worm:
Win32/Netsky. B@mm (MS(OneCare)) - Win32.
HLLM. Netsky. 18635 (DrWeb) - Win32/Netsky.
B worm (Nod32) - Win32.
Netsky. B@mm (BitDef7) - I-Worm.
NetSky. b (VirusBuster) - Win32:
Netsky-B [Wrm] (AVAST) - Email-Worm.
Win32. NetSky (Ikarus) - I-Worm/Netsky.
B (AVG) - note.
doc. pif <<< WORM/Netsky. #1 (AVIRA) - WORM/Netsky.
B. 1 (AVIRA) - W32.
Netsky. B@mm (NAV) - Netsky.
B@mm (Norman) - W32/SuspiciousZip.
Gen (Norman) - W32/Netsky.
B@mm (NAI) - WORM_NETSKY.
AQ (PCCIL) - Worm.
NetSky. b (Rising) - Email-Worm.
Win32. NetSky. b [AVP] (FSecure) - WORM_NETSKY.
AQ (TrendMicro) - BehavesLike.
Win32. Malware (v) (Sunbelt) - I-Worm.
NetSky. b (VirusBusterBeta)
© 1997-2010 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.