Content
W32/Netsky.p@MM
- Type
- Virus
- SubType
- Internet Worm
- Discovery Date
- 03/21/2004
- Length
- 29,568 bytes (mailed)
26,624 bytes (dropped) - Minimum DAT
- 4340 (03/22/2004)
- Updated DAT
- 4517 (06/20/2005)
- Minimum Engine
- 5.1.00
- Description Added
- 03/21/2004
- Description Modified
- 06/15/2006 12:59 AM (PT)
Risk Assessment
- Corporate User
- Low-Profiled
- Home User
- Low-Profiled
Tab Navigation
Characteristics
-- Update 22nd March 06:20 PST --
Due to increased prevalence, this threat has had its risk assessment raised to MEDIUM.
|
If you think that you may be infected with Netsky.p, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present. This is not required for McAfee users as McAfee products are capable of detecting and removing the virus with the latest update. (see the removal instructions below for more information). Note: Receiving an email alert stating that the virus came from your email address is not an indication that you are infected as the virus often forges the from address. |
|
A new variant of W32/Netsky@MM has been received which spreads through email like its predecessors. The main component is 29,568 bytes long, FSG packed. When run, the worm copies itself to the Windows directory as:
It creates the following files in the same directory:
Where the three zip archives are different in binary. The following registry keys are created:
Where %WinDir% is the Windows directory. Mail Propagation The worm sends mails using SMTP. Email sent has the following characteristics: From: (forged address taken from infected system)
Body: (Taken from the following list)
The worm exploits the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability in Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2), to automatically execute the virus on vulnerable systems. Attachment: (one of the following)
Where .zip file is the worm in a zip file. The mailing component harvests address from the local system. Files with the following extensions are targeted:
The virus sends itself via SMTP - constructing messages using its own SMTP engine. It queries the DNS server for the MX record and connects directly to the MTA of the targeted domain and sends the message. The virus will not mail itself to email addresses containing the following strings:
P2P Propagation The worm searches directories with the following strings:
It copies itself to these directories using the following file names:
|
Symptoms
Existence of the registry key and files mentioned above.
Method of Infection
The worm spreads by SMTP mail and P2P network.
Removal
All Users
Use specified
engine and DAT files
(or later) for detection and removal. In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Stinger
Stinger
has been updated to assist in detecting and repairing this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
- Terminate the FVPROTECT.EXE process using Windows Task Manager.
- Delete the following files from your Windows directory (typically c:\windows or c:\winnt):
- FVPROTECT.EXE
- USERCONFIG9X.DLL
- BASE64.TMP
- ZIP1.TMP
- ZIP2.TMP
- ZIP3.TMP
- ZIPPED.TMP
- Delete the many copies of the worm dropped on the victim machine, with the enticing filenames as described above.
- Edit the registry
- Delete the "Norton Antivirus AV" value from
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
- Delete the "Norton Antivirus AV" value from
- Reboot the system
Additional Windows ME/XP removal considerations
McAfee Threatscan
ThreatScan signatures that can detect the
W32/Netsky.p@MM
virus are available from:
- Threatscan 2.5 - ftp.nai.com/pub/security/tsc25/updates/winnt
- Threatscan 2.0/2.1 - ftp.nai.com/pub/security/tsc20/updates/winnt
ThreatScan Signature version: 2004-03-22
ThreatScan users can detect the virus by running a ThreatScan task using the following settings:
- Select the "Remote Infection Detection" category and "Windows Virus Checks" template.
-or-
- Select the "Other" category and "Scan All Vulnerabilities" template.
For additional information:
Run the "ThreatScan Template Report"
Look for module number #4066
Sniffer Distributed, Sniffer Portable and Netasyst Capture Recommendation:
Due to changing offset for Subject, Mail From, and attachments in the emails sent by this virus, and as it is not a network-aware worm, we cannot create a Sniffer filter for this virus.
Recommendation for customers:
- Create a capture profile with Capture on only SMTP traffic.
- Analyze the traffic for Subject, Mail To, and Attachments in the Decode mentioned in http://vil.nai.com/vil/content/v_101119.htm to identify if there is a virus propagating from specific IP's.
Variants
Variants
N/A
All Information
Overview -
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Aliases
- W32.Netsky.Q@mm (Symantec)
- WORM_NETSKY.P (Trend)
Characteristics
Characteristics -
-- Update 22nd March 06:20 PST --
Due to increased prevalence, this threat has had its risk assessment raised to MEDIUM.
|
If you think that you may be infected with Netsky.p, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present. This is not required for McAfee users as McAfee products are capable of detecting and removing the virus with the latest update. (see the removal instructions below for more information). Note: Receiving an email alert stating that the virus came from your email address is not an indication that you are infected as the virus often forges the from address. |
|
A new variant of W32/Netsky@MM has been received which spreads through email like its predecessors. The main component is 29,568 bytes long, FSG packed. When run, the worm copies itself to the Windows directory as:
It creates the following files in the same directory:
Where the three zip archives are different in binary. The following registry keys are created:
Where %WinDir% is the Windows directory. Mail Propagation The worm sends mails using SMTP. Email sent has the following characteristics: From: (forged address taken from infected system)
Body: (Taken from the following list)
The worm exploits the Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability in Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2), to automatically execute the virus on vulnerable systems. Attachment: (one of the following)
Where .zip file is the worm in a zip file. The mailing component harvests address from the local system. Files with the following extensions are targeted:
The virus sends itself via SMTP - constructing messages using its own SMTP engine. It queries the DNS server for the MX record and connects directly to the MTA of the targeted domain and sends the message. The virus will not mail itself to email addresses containing the following strings:
P2P Propagation The worm searches directories with the following strings:
It copies itself to these directories using the following file names:
|
Symptoms
Symptoms -
Existence of the registry key and files mentioned above.
Method of Infection
Method of Infection -
The worm spreads by SMTP mail and P2P network.
Removal -
Removal -
All Users
Use specified
engine and DAT files
(or later) for detection and removal. In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Stinger
Stinger
has been updated to assist in detecting and repairing this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
- Terminate the FVPROTECT.EXE process using Windows Task Manager.
- Delete the following files from your Windows directory (typically c:\windows or c:\winnt):
- FVPROTECT.EXE
- USERCONFIG9X.DLL
- BASE64.TMP
- ZIP1.TMP
- ZIP2.TMP
- ZIP3.TMP
- ZIPPED.TMP
- Delete the many copies of the worm dropped on the victim machine, with the enticing filenames as described above.
- Edit the registry
- Delete the "Norton Antivirus AV" value from
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
- Delete the "Norton Antivirus AV" value from
- Reboot the system
Additional Windows ME/XP removal considerations
McAfee Threatscan
ThreatScan signatures that can detect the
W32/Netsky.p@MM
virus are available from:
- Threatscan 2.5 - ftp.nai.com/pub/security/tsc25/updates/winnt
- Threatscan 2.0/2.1 - ftp.nai.com/pub/security/tsc20/updates/winnt
ThreatScan Signature version: 2004-03-22
ThreatScan users can detect the virus by running a ThreatScan task using the following settings:
- Select the "Remote Infection Detection" category and "Windows Virus Checks" template.
-or-
- Select the "Other" category and "Scan All Vulnerabilities" template.
For additional information:
Run the "ThreatScan Template Report"
Look for module number #4066
Sniffer Distributed, Sniffer Portable and Netasyst Capture Recommendation:
Due to changing offset for Subject, Mail From, and attachments in the emails sent by this virus, and as it is not a network-aware worm, we cannot create a Sniffer filter for this virus.
Recommendation for customers:
- Create a capture profile with Capture on only SMTP traffic.
- Analyze the traffic for Subject, Mail To, and Attachments in the Decode mentioned in http://vil.nai.com/vil/content/v_101119.htm to identify if there is a virus propagating from specific IP's.
Variants
Variants -
N/A
