What is the Netsky worm?

Netsky is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. This worm also searches drives C through Z for the folder names containing "Share" or "Sharing," and then copies itself to those folders.

Also known as: WORM_Netsky, W32/Netsky@MM, W32/Netsky.worm, Win32.Netsky

How Does the Netsky Worm Infect My Computer?

1. Creates a mutex named "AdmMoodownJKIS003." This mutex allows only one instance of the worm to execute in memory.
   
   
2. Copies itself as %Windir%\Services.exe.
   
   
3. Adds the value:
   
   "Service" = "%Windir%\services.exe -serv"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   so that it runs when you restart Windows.
   
   
4. Deletes the values:
   
   • "Taskmon"
   • "Explorer"
     
     from the registry keys:
     
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
     
     
5. Deletes the values:
   
   • "KasperskyAV"
   • "System."
     
     from the registry key:
     
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
     
     
6. Deletes the registry key:
   
   HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
   
   
7. May copy itself to the %Windir% folder as one of the following:
   • prod_info_55761.rtf.exe.zip
   • prod_info_65642.rtf.scr.zip
   • prod_info_33543.rtf.scr.zip
   • prod_info_56474.txt.exe.zip
   • prod_info_33325.txt.exe.zip
   • prod_info_77256.txt.scr.zip
   • prod_info_34157.htm.exe.zip
   • prod_info_87968.htm.scr.zip
   • prod_info_43859.htm.scr.zip
   • prod_info_56780.doc.exe.zip
   • prod_info_43631.doc.exe.zip
   • prod_info_47532.doc.scr.zip
   • prod_info_54433.doc.exe.zip
     
     
8. Retrieves email addresses from the files with the following file extensions:
   
   • .msg
   • .oft
   • .sht
   • .dbx
   • .tbb
   • .adb
   • .doc
   • .wab
   • .asp
   • .uin
   • .rtf
   • .vbs
   • .html
   • .htm
   • .pl
   • .php
   • .txt
   • .eml
     
     
9. Searches drives C through Z for the folder names containing the words "Share" or "Sharing." If the drive is not a CD-ROM, the worm copies itself as the following:
   • doom2.doc.pif
   • sex sex sex sex.doc.exe
   • rfc compilation.doc.exe
   • dictionary.doc.exe
   • win longhorn.doc.exe
   • e.book.doc.exe
   • programming basics.doc.exe
   • how to hack.doc.exe
   • max payne 2.crack.exe
   • e-book.archive.doc.exe
   • virii.scr
   • nero.7.exe
   • eminem - lick my pussy.mp3.pif
   • cool screensaver.scr
   • serial.txt.exe
   • office_crack.exe
   • hardcore porn.jpg.exe
   • angels.pif
   • porno.scr
   • matrix.scr
   • photoshop 9 crack.exe
   • strippoker.exe
   • dolly_buster.jpg.pif
   • winxp_crack.exe
     
     
10. Uses its own SMTP engine to send itself to the email addresses it found.
    
    The email has the following characteristics:
    
    From: (Spoofed as one of the following):
    
    • Ebay Auctions <responder@ebay.com>    
    • Yahoo Auctions <auctions@yahoo.com>
    • Amazon automail <responder@amazon.com>
    • MSN Auctions <auctions@msn.com>
    • QXL Auctions <responder@qxl.com>
    • EBay Auctions <responder@ebay.com>
      

Subject: Auction successful!

Message:
#----------------- message was sent by automail agent ------------------#


Congratulations!


You were successful in the auction.

Auction ID       :<4 random digits>-<4 random digits>-<4 random digits>-A
Product ID       :<4 random digits>-<4 random digits>-<4 random digits>-P

A detailed description about the product and the bill
are attached to this mail.
Please contact the seller immediately.

Thank you!

Attachment: (One of the following):

• prod_info_55761.rtf.exe.zip
• prod_info_65642.rtf.scr.zip
• prod_info_33543.rtf.scr.zip
• prod_info_56474.txt.exe.zip
• prod_info_33325.txt.exe.zip
• prod_info_77256.txt.scr.zip
• prod_info_34157.htm.exe.zip
• prod_info_87968.htm.scr.zip
• prod_info_43859.htm.scr.zip
• prod_info_56780.doc.exe.zip
• prod_info_43631.doc.exe.zip
• prod_info_47532.doc.scr.zip
• prod_info_54433.doc.exe.zip
• prod_info_42314.pif
• prod_info_54235.scr
• prod_info_49146.exe
• prod_info_33967.cmd
• prod_info_42818.pif
• prod_info_54739.scr
• prod_info_04650.bat
• prod_info_49541.exe
• prod_info_33462.cmd
• prod_info_42313.pif
• prod_info_54234.scr
• prod_info_04155.bat

How to Remove the Netsky Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Netsky during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Netsky worm.

1. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

2. Terminating the Running Program

1. Open Windows Task Manager.
   On Windows 95/98/ME systems, press
   CTRL+ALT+DELETE
   On Windows NT/2000/XP systems, press
   CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the process:
   SERVICES.EXE
3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. Do the same for all detected malware files in the list of running processes.
5. To check if the malware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.

3. Removing Autostart Entries from the Registry

1. Open Registry Editor. To do this, click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   service = "%Windows%\services.exe -serv"
4. Close Registry Editor.

4. Updating the Virus Definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

5. Run a full system scan and delete all the files detected as Netsky.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Netsky, click Delete.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Do you think this website is useful? Help us to keep the site growing.

Detect and Removal Instruction for Other Variants: