|
Threat Center |
| Threat Center Threats Explained Threat Encyclopedia Threat Blog Security Tips Case Studies White Papers Newsletter Signup |
Win32/NetSky.BWin32/NetSky.B is a worm spreading in a form of an e-mail attachment and via shared files in LAN networks or in P2P networks. It is compressed using the UPX utility. When compressed its size is 22106 B. After its decompression its size increases to 41984 B. Note: In following text a symbolic inscription %windir% is used instead of the name of directory in which Windows operating system is installed. Of course, this may differ from installation to installation. The subdirectory System or System32 placed in %windir% has a name %system%. The NetSky.B creates a mutex named “ AdmSkynetJklS003 ”, using which it makes sure that only one copy of it is running on the infected computer. If the worm is run without any parameters the worm displays an error window with a message: “ The file could not be opened! ”. The worm copies itself into the %windir% directory using the following name: services.exe. The worm adds the following entry into the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key: service The key contains the following value: %windir%\services.exe –serv Due to using the parameter –serv the error message will not be displayed the next time the worm will be run (after each restart of the computer). The worm removes the following registry entries: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Taskmon The worm searches all the local disk drives, except CD-ROM drives, for directories with names containing strings share or sharing. Whenever the worm finds those directories it copies itself into them using all the following names: winxp_crack.exe NetSky.B is able to spread via P2P networks using this mechanism. The worm harvest e-mail addresses for its spreading from files found on the infected computer of the following extensions: .eml When spreading via e-mail the worm uses one of the following words for the Subject line: hi The body of the message sends by the worm contains one of the following words: anything ok? The file attached to the e-mail has two extensions. The first one is one of the following extensions: .txt , .doc , .rtf and the second extension is one of the following extensions: .exe , .scr , .com or .pif . The detection of Win32/NetSky.B using sample is added since version 1.627 . PROTECT YOUR COMPUTER!
|
|
Solutions -
Products -
Purchase -
Download -
Support -
Threat Center -
Partners -
Company -
Global Sites
Copyright© 2006 by ESET, LLC. All rights reserved. |