W32/Netsky.I Worm

 Information about the W32/Netsky.I worm:

W32/Netsky.I is a mass mailing worm. This worm infects Windows systems and spreads through email.

The infected email carries the following 'From' address;

service@(user's domain).com

The subject of the infected email will be any one of the following;

Mail account closed
Mail accounnt deactivated
Mail account expired

The body of the email will be any one of the following;

Your mail account has been closed. Click on the link for further details.
Your mail account has been deactivated. To reactivate, follow the link.
Your mail account expired. Please follow the link to reactivate.

The infected email has an attachment which looks like a hyperlink;

http://www.(user's domain).com/username/index.scr

Upon execution of the infected attachment, the worm copies itself as FOODING.EXE in the Windows folder. It creates a mutex KO[SkyNet.cz]SystemsMutex to check the presence of the worm in system memory.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.wab
.vbs
.uin
.txt
.tbb
.shtm
.sht
.rtf
.pl
.php
.oft
.msg
.html
.htm
.eml
.doc
.dhtm
.dbx
.cgi
.asp
.adb

The worm skips certain email addresses, which contain the following text strings, to evade security software detection:

ymantec
sophos
skynet
orton
orman
messagelabs
itdefender
iruslis
icrosoft
freeav
f-secur
f-pro
cafee
aspersky
antivir
antivi
andasoftwa
abuse

After this, the worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on March 8, 2004.

 Other names of W32/Netsky.I worm:

This worm is also known as W32/NetSky.I@mm, I-Worm.NetSky.i, W32.NetSky.I@mm.