What is the Netsky.S worm?

Netsky.S is a mass-mailing worm and a variant of Netsky.R. It also contains backdoor functionality and may perform Denial of Service (DoS) attack against specified Web sites. The email has a variable subject line and attachment name. The attachment will have a .pif file extension.

Also known as: WORM_Netsky.S, W32/Netsky.S@MM, W32/Netsky.S.worm, Win32.Netsky.S

How Does the Netsky.S Worm Infect My Computer?

When Netsky.S runs, it does the following:

1. Copies itself as %Windir%\EasyAV.exe.
   
   
2. Creates the mutex's "Protect_USUkUyUnUeUtU_Mutex" and "SyncMutex_USUkUyUnUeUtU" to allow only one instance of the worm to execute.
   
   
3. Creates the file, %Windir%\Uinmzertinmds.opm, which contains a MIME-encoded copy of the worm's executable.
   
   
4. Adds the value:
   
   "EasyAV"="%Windir%\EasyAV.exe"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   so that the worm runs when you start Windows.
   
   
5. Listens on port 6789. If the attacker sends an executable file to an infected computer, the worm will save it as <Random.Filename>.exe, and then execute that file.
   
   
6. If the system date is between April 14, 2004 to April 23, 2004, the worm will try to perform a DoS attack against the following Web sites:
   
   • www.cracks.am
   • www.emule.de
   • www.kazaa.com
   • www.freemule.net
   • www.keygen.us
     
     
7. Scans drives C through Z (excluding CD-ROM drives) and retrieves email addresses from the files with the following extensions:
   
   • .eml
   • .txt
   • .php
   • .asp
   • .wab
   • .doc
   • .sht
   • .oft
   • .msg
   • .vbs
   • .rtf
   • .uin
   • .shtm
   • .cgi
   • .dhtm
   • .adb
   • .tbb
   • .dbx
   • .pl
   • .htm
   • .html
   • .jsp
   • .wsh
   • .xml
   • .cfg
   • .mbx
   • .mdx
   • .mht
   • .mmf
   • .nch
   • .ods
   • .stm
   • .xls
   • .ppt
     
     
8. If the system date is not April 2004, or if it is and the day is less than 14 or greater than 16, the worm will attempt to use its own SMTP engine to send itself to all the email addresses that it finds.

How to Remove the Netsky.S Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Netsky.S during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Netsky.S worm.

1. Restarting in Safe Mode

On Windows 95

1. Restart your computer.
2. Press F8 at the "Starting Windows 95" message.
3. Choose Safe Mode from the Windows 95 Startup Menu then press Enter.

On Windows 98/ME

1. Restart your computer.
   
2. Press the CTRL key until the Windows 98 startup menu appears.
   
3. Choose the Safe Mode option then press Enter.

On Windows NT (VGA mode)

1. Click Start>Settings>Control Panel.
2. Double-click the System icon.
3. Click the Startup/Shutdown tab.
4. Set the Show List field to 10 seconds and click OK to save this change.
5. Shut down and restart your computer.
6. Select VGA mode from the startup menu.

1. Restart your computer.
   
2. Press the F8 key when prompted.
3. If Windows XP Professional starts without the "Press select operating system to start" menu, restart your computer.
   
4. Press F8 after the Power-On Self Test (POST) is done.
5. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

1. Restart your computer.
   
2. Press the F8 key, when you see the Starting Windows bar at the bottom of the screen.
   
3. Choose the Safe Mode option from the Windows 2000 Advanced Options Menu then press Enter

2. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

3. Updating the Virus Definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

4. Identifying the Virus Program

1. Scan your system with your Kaspersky antivirus products.
2. NOTE all files detected as Netsky.S.

5. Removing Autostart Entries from the Registry

1. Open Registry Editor. To do this, click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry or entries whose data value (in the rightmost column) is the malware file(s) detected earlier.
4. Close Registry Editor.

6. Run a full system scan and delete all the files detected as Netsky.S.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Netsky.S, click Delete.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Detect and Removal Instruction for Other Variants: