What
is the Netsky.G worm?
Netsky.G is a mass-mailing worm that uses its
own SMTP engine to send itself to the email
addresses it finds when scanning hard drives and
mapped drives.
Also
known as: WORM_NETSKY.G, W32/Netsky.g@MM, W32/Netsky.G.worm, Win32.Netsky.G
How
Does the Netsky.G Worm Infect My Computer?
When Netsky.G runs, it does the following:
- Creates a mutex named "Netsky AV
Guard." This mutex allows only one
instance of the worm to execute.
- It copies itself to %Windir%\Avguard.exe.
- Adds the value:
"Special Firewall Service" = %WinDir%\avguard.exe
-av service
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the worm runs when you start Windows.
- Deletes the values:
- Taskmon
- Explorer
- Windows Services Host
- KasperskyAV
from the registry keys:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run
- Deletes the values:
- System.
- msgsvr32
- DELETE ME
- service
- Sentry
from the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run
- Deletes the values:
- d3dupdate.exe
- au.exe
- OLE
- gouday.exe
- rate.exe
- sysmon.exe
- srate.exe
- ssate.exe
- sate.exe
from the registry key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run
- Deletes the value: System.
from the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices
- Also does the same actions as
Netsky.C Worm described in "How Does the
Netsky.C Worm Infect My Computer?" from 8-10.
Click here
to see details.
- If an infected computer's time is between
6:00 A.M. and 9:00 A.M. on Wednesday, March
10, 2004, the PC speaker will beep in a
continuous loop. Each beep will be for a
random period of time, at a random frequency.
- The email has the following characteristics:
Subject: (One of the following)
- Re: Your website
- Re: Your product
- Re: Your letter
- ......
Body: (One of the following)
- Your file is attached.
- Please read the attached file.
- Please have a look at the attached
file.
- See the attached file for details.
- Here is the file.
- Your document is attached.
Attachment: (One of the following)
- your_website.pif
- your_product.pif
- your_letter.pif
- ......
- Avoids sending to email addresses that
contain any of the following strings:
- iruslis
- antivir
- sophos
- freeav
- andasoftwa
- skynet
- messagelabs
- abuse
- fbi
- orton
- f-pro
- aspersky
- cafee
- orman
- itdefender
- f-secur
- avp
- spam
- ymantec
- antivi
- icrosoft
How to Remove the Netsky.G Worm?
Kaspersky Internet Security Can Prevent You From Virus and Intrusion.
If Kaspersky detects Netsky.G during the
scan, it will AUTOMATICALLY offer you the option
of deleting it. Do this by following the
program's instructions.
Follow these steps
in removing the Netsky.G worm.
1. Disabling System Restore (Windows Me/XP)
For instructions on how to turn off System
Restore, read your Windows documentation, or one
of the following articles: "How
to disable or enable Windows Me/XP System Restore".
2. Removing Autostart Entries from the
Registry
- Open Registry Editor. To do this,
click Start>Run, type Regedit, then press
Enter.
- In the left panel, double-click the
following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
- In the right panel, locate and delete the
entry or entries:
Special Firewall Service="%Windows%\avguard.exe
-av service"
Note: %Windows% is the default Windows
folder, usually C:\Windows or C:\WINNT.
- Close Registry Editor.
3. Terminating the Running Program
- Open Windows Task Manager.
On Windows 95/98/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, and click the Processes tab.
- In the list of running programs*, locate the
process:
AVGUARD.EXE
- Select the malware process, then press
either the End Task or the End Process button,
depending on the version of Windows on your
system.
- To check if the malware process has been
terminated, close Task Manager, and then open
it again.
- Close Task Manager.
4. Deleting the Virus File
On Windows 9x/NT
- Click Start>Find>Files and Folders.
- In the Named input box, type:
AVGUARD.EXE
- In the Look In drop-down list, select the
drive which contains Windows, then press
Enter.
- Once located, delete the file.
On Windows 2000/ME/XP
- Click Start>Search>For Files and
Folders.
- In the Search for files and folders named
input box, type:
AVGUARD.EXE
- In the Look In drop-down list, select the
drive which contains Windows, then press
Enter.
- Once located, delete the file.
5. Updating the virus definitions
If you do not know which anti-virus software
can provide strong protection for you, Kaspersky Internet Security is recommended.
6. Run a full system scan and delete all the
files detected as Netsky.G.
- Start your Kaspersky Internet Security and make sure that it is
configured to scan all the files.
- Run a full system scan.
- If any files are detected as infected with
Netsky.G, click Delete.
How to Disinfect My Computer from Worms?
In order to keep your computer protected, bear
the following tips in mind:
- If you have filtering tools installed,
configure them to reject messages with the
characteristics described above. If, in spite
of doing this, you receive the message that
contains the virus: do not open it, do not run
the attached file and delete it, making sure
that you also delete it from the Deleted
Items folder.
- Install a good antivirus in your computer.
Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
- Keep your antivirus updated. If automatic
updates are available, configure your
antivirus to use them.
- Keep your permanent antivirus protection
enabled at all times.
Do
you think this website is useful? Help us to keep
the site growing.
Detect and Removal Instruction for Other
Variants:
| 
