A new variant of W32/Netsky@MM has been received which is detected and repaired as W32/Netsky.c@MM
with the 4328 DATs
and higher with scanning of compressed files enabled (W32/Netsky.gen@MM since the 4331 DATs).
This variant is very similar to W32/Netsky.f@MM
This virus spreads via email. It sends itself to addresses found on the victim's machine. The virus also attempts to deactivate the various other viruses (variants of W32/Mydoom and W32/Bagle).
The virus may be received in an email message as follows:
(forged address taken from infected system)
- Re: Your website
- Re: Your product
- Re: Your letter
- Re: Your archive
- Re: Your text
- Re: Your bill
- Re: Your details
- Re: My details
- Re: Word file
- Re: Excel file
- Re: Details
- Re: Approved
- Re: Your software
- Re: Your music
- Re: Here
- Re: Re: Re: Your document
- Re: Hello
- Re: Hi
- Re: Re: Message
- Re: Your picture
- Re: Here is the document
- Re: Your document
- Re: Thanks!
- Re: Re: Thanks!
- Re: Re: Document
- Re: Document
- Your file is attached
- Please read the attached file
- Please have a look at the attached
- See the attached file for details
- Here is the file
- Your document is attached.
Note: initial investigation indicates that the worm may email itself either as a binary or as a binary within a ZIP file. This will be updated when analysis is complete.
The mailing component harvests address from the local system. Files with the following extensions are targeted:
It does not send itself to addresses that contain one of the following strings:
The virus sends itself via SMTP - constructing messages using its own SMTP engine. It queries the DNS server for the MX record and connects directly to the MTA of the targeted domain and sends the message.
The worm copies itself into %WinDir% (eg. C:\WINDOWS) folder using the filename AVGUARD.EXE.
- C:\WINNT\avguard.exe (27,648 bytes)
A Registry key is created to load the worm at system start.
"Special Firewall Service" = %WinDir%\avguard.exe -av service