W32/Netsky.D Worm

 Information about the W32/Netsky.D worm:

W32/Netsky.D is a mass mailing worm. This is a variant of W32/Netsky.C worm. This worm infects Windows systems. This worm spreads through email.

The infected email carries a fake 'From' address, picked up from the infected system.

The subject of the infected email will be any one of the following;

Re: Approved
Re: Details
Re: Document
Re: Excel file
Re: Hello
Re: Here
Re: Here is the document
Re: Hi
Re: Message
Re: My details
Re: Thanks!
Re: Word file
Re: Your archive
Re: Your bill
Re: Your details
Re: Your document
Re: Your letter
Re: Your music
Re: Your picture
Re: Your product
Re: Your software
Re: Your text
Re: Your website

The body of the email will be any one of the following;

Here is the file.
Your file is attached.
Your document is attached.
Please read the attached file.
Please have a look at the attached file.
See the attached file for details.

The infected email will be having an attachment with any one of the following names;

all_document.pif
application.pif
document.pif
document_4351.pif
document_excel.pif
document_full.pif
document_word.pif
message_details.pif
message_part2.pif
mp3music.pif
my_details.pif
your_archive.pif
your_bill.pif
your_details.pif
your_document.pif
your_file.pif
your_letter.pif
your_picture.pif
your_product.pif
your_text.pif
your_website.pif
yours.pif

Upon execution of the infected attachment, the worm copies itself as WINLOGON.EXE in the Windows folder.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.php, .pl, .rtf, .sht, .tbb, .txt, .uin, .vbs, .wab, .adb, .asp, .dbx, .doc, .eml, .htm, .html, .msg, .oft

After this, the worm mails itself to these addresses using its own SMTP engine.

The worm may de-activate some variants of W32/Mydoom in the infected system.

This worm first appeared on March 1, 2004.

 Other names of W32/Netsky.D worm:

This worm is also known as W32/Netsky.D@MM, WORM_NETSKY.D.