What is the Netsky.B worm?

Netsky.B is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. This worm also searches drives C through Z for folder names containing "Share" or "Sharing," and then copies itself to those folders.

The Subject, Body, and email attachment vary.

Also known as: W32.Netsky.B, W32/Netsky.b@MM, W32/Netsky.B.worm, WORM_NETSKY.B, Moodown.B, I-Worm.Moodown.b

How Does the Netsky.B Worm Infect My Computer?

When Neysky.B runs, it does the following:

1. Creates a mutex named "AdmSkynetJKIS003." This mutex allows only one instance of the worm to execute.
   
2. Displays the following dialog box:
   The file could not be opened!
   
3. Copies itself as %Windir%\services.exe.
   
4. Adds the value:
   "service" = "%Windir%\services.exe -serv"
   
   to the registry key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   so that the worm runs when you start Windows.
   
5. Deletes the values:
   
   • "Taskmon"
   • "Explorer"
     
     from the registry keys:
     
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
     RunServices
     
6. Deletes the values:
   
   • "KasperskyAV"
   • "System."
     
     from the registry key:
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
     
     
7. Deletes the registry key:
   HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\
   InProcServer32
   
8. Retrieves email addresses from files on the computer that have the following extensions:
   
   • .msg
   • .oft
   • .sht
   • .dbx
   • .tbb
   • .adb
   • .doc
   • .wab
   • .asp
   • .uin
   • .rtf
   • .vbs
   • .html
   • .htm
   • .pl
   • .php
   • .txt
   • .eml
     
9. Searches drives C through Z for folder names containing the words "Share" or "Sharing." If the drive is not a CD-ROM, the worm copies itself to the matching folders and all the subfolders below it as the following:
   
   • doom2.doc.pif
   • sex sex sex sex.doc.exe
   • rfc compilation.doc.exe
   • dictionary.doc.exe
   • win longhorn.doc.exe
   • e.book.doc.exe
   • programming basics.doc.exe
   • how to hack.doc.exe
   • max payne 2.crack.exe
   • e-book.archive.doc.exe
   • virii.scr
   • nero.7.exe
   • eminem - lick my pussy.mp3.pif
   • cool screensaver.scr
   • serial.txt.exe
   • office_crack.exe
   • hardcore porn.jpg.exe
   • angels.pif
   • porno.scr
   • matrix.scr
   • photoshop 9 crack.exe
   • strippoker.exe
   • dolly_buster.jpg.pif
   • winxp_crack.exe
     
10. Uses its own SMTP engine to send itself to the email addresses it found above.
    
    The email has the following characteristics:
    
             From: (Spoofed)
    
             Subject: (One of the following)
    
    • hi
    • hello
    • read it immediately
    • ......
      
      Message: (One of the following)
      
    • anything ok?
    • what does it mean?
    • ok
    • ......
      
      Attachment:
      W32.Netsky.B@mm will create a .zip file as the attachment 51.5% of the time, which randomly chooses one of the Attachment Names below. The archive contains an executable copy of the worm, which also randomly chooses one of the Attachment Names below.
      
      The rest of the time the worm will use a copy of itself as the attachment, and randomly choose one of the Attachment Names below.
      
      Attachment Name: (One of the following)
      
    • document
    • msg
    • doc
    • ......
      
      Extensions:
      If the attachment is an executable file, the worm will create a double extension 53.8% of the time. If the attachment is a .zip file, then the executable within the .zip will have a double extension 33% of the time. The first, variable extension in these cases will be one of the following:
      
    • .txt
    • .rtf
    • .doc
    • .htm
      
      All executables will end with one of the following extensions:
      
    • .exe
    • .scr
    • .com
    • .pif
      
      
11. Creates .zip files in the %Windir% folder, which contain copies of the worm. The names of these files match the above Attachment Names.

How to Remove the Netsky.B Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Netsky.B during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Netsky.B worm.

1. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

2. Updating the Virus Definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

3. Identifying the Virus Program

1. Scan your system with your Kaspersky antivirus products.
2. NOTE all files detected as NETSKY.B.

4. Terminating the Running Program

1. Open Windows Task Manager.
   On Windows 95/98/ME systems, press
   CTRL+ALT+DELETE
   On Windows NT/2000/XP systems, press
   CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the malware file or files detected earlier.
3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. Do the same for all detected malware files in the list of running processes.
5. To check if the malware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.

5. Removing Autostart Entries from the Registry

1. Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   service = %Windows%\services.exe -serv
   Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WinNT.
4. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>{E6FB5E20-DE35-11CF-9C87-00AA005127ED}
5. Right-click the following key and add a new subkey named:
   InProcServer32
6. In the right panel, double-click the (Default) entry and change its value to:
   %System%\WEBCHECK.DLL
   Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.
7. Close Registry Editor.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Netsky.B, click Delete.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Do you think this website is useful? Help us to keep the site growing.

Detect and Removal Instruction for Other Variants: