W32/Netsky.L Worm

 Information about the W32/Netsky.L worm:

W32/Netsky.L is a mass mailing worm. This worm infects Windows systems and spreads through email.

The subject of the infected email will be any one of the following;

Re: Approved
Re: Important
Re: Your details
Re: Your document

The body of the email will be any one of the following;

Your file is attached.
Your document is attached.
Please see the attached file for details.
Please read the document.
Please read the attached file.

The infected email has an attachment with any one of the following names;

<username>.pif
details_<username>.pif
document_<username>.pif
your_file_<username>.pif

(Where <user name> is taken from the gathered email addresses, which is usually the portion of the recipient's email address prior to @).

Upon execution of the infected attachment, the worm copies itself as AVPROTECT.EXE in the Windows folder. It creates a mutex Rabbo to check the presence of the worm in system memory. .

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system and network shared drives;

.xml
.wsh
.wab
.vbs
.uin
.txt
.tbb
.shtm
.sht
.rtf
.pl
.php
.oft
.msg
.jsp
.html
.htm
.eml
.doc
.dhtm
.dbx
.cgi
.asp
.adb

This worm first appeared on March 10, 2004.

 Other names of W32/Netsky.L Worm:

This worm is also known as W32.Netsky.Gen@MM, W32/Netsky-L, NetSky.L.