McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• W32.Netsky.X@mm (NAV)

• WORM_NETSKY.X (Trend)

Characteristics

This worm is detected with current DATs as W32/Netsky.gen@MM with scanning compressed files enabled. Specific detection will be added to the 4352 DATs.  

It bears the following characteristics:

• constructs messages using its own SMTP engine
• harvests email addresses from the victim machine
• spoofs the From: address of messages
• delivers a DoS attack on certain web sites.

Mail Propagation

Email addresses are harvested from the victim machine. Files with the following extensions are searched:

• .adb
• .asp
• .cfg
• .cgi
• .dbx
• .dhtm
• .doc
• .eml
• .htm
• .html
• .jsp
• .mbx
• .mdx
• .mht
• .mmf
• .msg
• .nch
• .ods
• .oft
• .php
• .pl
• .ppt
• .rtf
• .sht
• .shtm
• .stm
• .tbb
• .txt
• .uin
• .vbs
• .wsh
• .wab
• .xls
• .xml

Subject : (Taken from the following list ):

• Re: document
• Re: belge
• Re: dokumenten
• Re: dokumentoida
• Re: udokumentowac
• Re: dokumentet
• Re: original
• Re: documento
• Re: dokument

Body: (Taken from the following list) :

• Please read the document
• Bitte lesen Sie das Dokument.
• Veuillez lire le document.
• Legga prego il documento.
• Leia por favor o original.
• Behage lese dokumentet.
• Podobac sie przeczytac ten udokumentowac.
• Haluta kuulua dokumentoida.
• mutlu etmek okumak belgili tanimlik belge.

System Changes

The worm installs itself on the victim machine as FirewallSvr.exe in the Windows directory:

• %WinDir%\FirewallSvr.exe

The following Registry key is added to hook system startup:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
  Run "FirewallSvr" = %WinDir%\FirewallSvr.exe

A base64 encoded version of the worm is also dropped into the %Windir% folder.

For Example:  C:\Winnt\f**k_you_bagle.txt

Denial of Service

If the local system date is between April 28th and April 30th , it targets the following remote servers in a denial of service attack:

• www.educa.ch
• www.nedinfo.ufl.edu
• www.nibis.de

Symptoms

Method of Infection

This worm spreads by email, constructing messages using its own SMTP engine

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• W32.Netsky.X@mm (NAV)

• WORM_NETSKY.X (Trend)

Characteristics

Characteristics -

This worm is detected with current DATs as W32/Netsky.gen@MM with scanning compressed files enabled. Specific detection will be added to the 4352 DATs.  

It bears the following characteristics:

• constructs messages using its own SMTP engine
• harvests email addresses from the victim machine
• spoofs the From: address of messages
• delivers a DoS attack on certain web sites.

Mail Propagation

Email addresses are harvested from the victim machine. Files with the following extensions are searched:

• .adb
• .asp
• .cfg
• .cgi
• .dbx
• .dhtm
• .doc
• .eml
• .htm
• .html
• .jsp
• .mbx
• .mdx
• .mht
• .mmf
• .msg
• .nch
• .ods
• .oft
• .php
• .pl
• .ppt
• .rtf
• .sht
• .shtm
• .stm
• .tbb
• .txt
• .uin
• .vbs
• .wsh
• .wab
• .xls
• .xml

Subject : (Taken from the following list ):

• Re: document
• Re: belge
• Re: dokumenten
• Re: dokumentoida
• Re: udokumentowac
• Re: dokumentet
• Re: original
• Re: documento
• Re: dokument

Body: (Taken from the following list) :

• Please read the document
• Bitte lesen Sie das Dokument.
• Veuillez lire le document.
• Legga prego il documento.
• Leia por favor o original.
• Behage lese dokumentet.
• Podobac sie przeczytac ten udokumentowac.
• Haluta kuulua dokumentoida.
• mutlu etmek okumak belgili tanimlik belge.

System Changes

The worm installs itself on the victim machine as FirewallSvr.exe in the Windows directory:

• %WinDir%\FirewallSvr.exe

The following Registry key is added to hook system startup:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
  Run "FirewallSvr" = %WinDir%\FirewallSvr.exe

A base64 encoded version of the worm is also dropped into the %Windir% folder.

For Example:  C:\Winnt\f**k_you_bagle.txt

Denial of Service

If the local system date is between April 28th and April 30th , it targets the following remote servers in a denial of service attack:

• www.educa.ch
• www.nedinfo.ufl.edu
• www.nibis.de

Symptoms

Symptoms -

Method of Infection

Method of Infection -

This worm spreads by email, constructing messages using its own SMTP engine

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A