What is the Netsky.F worm?

Netsky.F is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.

Also known as: WORM_NETSKY.F, W32/Netsky.f@MM, W32/Netsky.F.worm, Win32.Netsky.F

How Does the Netsky.F Worm Infect My Computer?

When Netsky.F runs, it does the following:

1. Creates a mutex named "LK[SkyNet.cz]SystemsMutex." This mutex allows only one instance of the worm to execute.
   
2. It copies itself to %Windir%\svchost.exe.
   
3. Adds the value:
   
   "Zone Labs Client Ex"="%windir%\svchost.exe -antivirus service"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   so that the worm runs when you start Windows.
   
4. Deletes the values:
   
   • Taskmon
   • Explorer
   • KasperskyAV
   • system.
   • msgsvr32
   • DELETE ME
   • service
   • Sentry
   • Windows Service Host
     
     from the registry key:
     
     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
     
5. Deletes the values:
   
   • Explorer
   • KasperskyAV
   • system.
   • d3dupdate.exe
   • au.exe
   • OLE
   • Windows Service Host
   • gouday.exe
   • rate.exe
   • sysmon.exe
     
     from the registry key:
     
     HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
     
6. Deletes the registry keys:
   
   • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
     Explorer\PINF
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WksPatch
     
7. If it is between 6:00 A.M. and 9:00 A.M. on Tuesday, March 2, 2004, the PC speaker will beep in a continuous loop. Each beep will be for a random period of time, at a random frequency.
   
8. Scans the following file types on drives C through Z for email addresses:
   
   • .dhtm
   • .cgi
   • .shtm
   • .msg
   • .oft
   • .sht
   • .dbx
   • .tbb
   • .adb
   • .doc
   • .wab
   • .asp
   • .uin
   • .rtf
   • .vbs
   • .html
   • .htm
   • .pl
   • .php
   • .txt
   • .eml
     
9. Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once. The worm uses the local DNS server (retrieved via an API), if available, to perform an MX lookup for the recipient address. If the local DNS fails, it will perform the lookup from the following list of hard-coded servers:
   
   • 212.44.160.8
   • 195.185.185.195
   • 151.189.13.35
   • 213.191.74.19
   • 193.189.244.205
   • 145.253.2.171
   • 193.141.40.42
   • 194.25.2.134
   • 194.25.2.133
   • 194.25.2.132
   • 194.25.2.131
   • 193.193.158.10
   • 212.7.128.165
   • 212.7.128.162
   • 193.193.144.12
   • 217.5.97.137
   • 195.20.224.234
   • 194.25.2.130
   • 194.25.2.129
   • 212.185.252.136
   • 212.185.253.70
   • 212.185.252.73
   • 62.155.255.16
     
10. The email has the following characteristics:
    
              Subject: (One of the following)
    • Re: Your website
    • Re: Your product
    • Re: Your letter
    • ......
      
      Body: (One of the following)
    • Your file is attached.
    • Please read the attached file.
    • Please have a look at the attached file.
    • See the attached file for details.
    • Here is the file.
    • Your document is attached.
      
      Attachment: (One of the following)
    • your_website.pif
    • your_product.pif
    • your_letter.pif
    • ......
      
11. Avoids sending to email addresses that contain any of the following strings:
    • iruslis
    • antivir
    • sophos
    • freeav
    • andasoftwa
    • skynet
    • messagelabs
    • abuse
    • fbi
    • orton
    • f-pro
    • aspersky
    • cafee
    • orman
    • itdefender
    • f-secur
    • avp
    • spam
    • ymantec
    • antivi
    • icrosoft

How to Remove the Netsky.F Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Netsky.F during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Netsky.F worm.

1. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

2. Updating the Virus Definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

3. Identifying the Virus Program

1. Scan your system with your Kaspersky antivirus products.
2. NOTE all files detected as NETSKY.F.

4. Terminating the Running Program

1. Open Windows Task Manager.
   On Windows 95/98/ME systems, press
   CTRL+ALT+DELETE
   On Windows NT/2000/XP systems, press
   CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the malware file or files detected earlier.
3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. Do the same for all detected malware files in the list of running processes.
5. To check if the malware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.

5. Removing Autostart Entries from the Registry

1. Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry or entries:
   Zone Labs Client Ex = "%Windows%\svchost.exe -antivirus service"
   Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WINNT.

6. Restoring Deleted Registry Keys

1. In the left panel of Registry Editor, double-click to the following subkey:
   HKEY_CLASSES_ROOT>CLSID>{E6FB5E20-DE35-11CF-9C87- 00AA005127ED}
2. Right-click the subkey, select New, and then click Key.
3. Type "InProcServer32" to name the new key.
4. In the right panel, right-click (Default) and click Modify.
5. Under Value Data, type the following string:
   %Root Folder%\System32\webcheck.dll
   Note: %Root Folder% is usually C:\.)
6. Click OK.
7. Close Registry Editor.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Netsky.F, click Delete.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Do you think this website is useful? Help us to keep the site growing.

Detect and Removal Instruction for Other Variants: