This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Existence of the files and registry keys mentioned above. Unexpected network traffic.
-- Update February 3, 2005 --
The assessment of this threat has been downgraded to Low-Profiled due to a decrease in prevalence. -- -- Update October 14th 2004 -- Due to an increase in prevalence the risk assessment of this threat is being raised to Medium
--
This variant of W32/Netsky is very similar to previous variants. It bears the following characteristics:
System Changes
When run, the worm displays a message box "File corrupted replace this!".
The worm installs itself on the victim machine as MsnMsgrs.exe in the Windows directory:
The following Registry key is added to hook system startup:
It copies itself to Windows directory as the following files:
Mail Propagation
Email addresses are harvested from the victim machine. Files with the following extensions are searched:
Constructed messages bear the following characteristics:
From: This is spoofed (using harvested email addresses) Subject: (One of the following)
Body: (One of the following)
Attachment: (One of the following)
The following file extensions are used:
Network propagation/Peer to Peer propagation
The worm copies itself to local folders containing string share or sharing , network shares and P2P shared folders. It uses the following file names:
All Users : Please use the latest released engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Manual Removal Instructions To remove this virus "by hand", follow these steps:
McAfee IntruShield An IntruShield User-Defined Signature (UDS) has been created to detect this threat and is available for download at: https://mysupport.nai.com/ Knowledgebase Article KB38001 Please note: The above knowledgebase article is password protected and requires you to log into Service Portal before accessing it.
Network General Sniffer A Network General Sniffer filter is available at http://www.networkgeneral.com/SnifferFilters_Details.aspx?Type=1
Risk Assessment:
Date Discovered:
Type/Sub-Type: