W32/Netsky.M Worm

 Information about the W32/Netsky.M worm:

W32/Netsky.M is a mass mailing worm. This worm is a variant of W32/Netsky.L. This worm infects Windows systems and spreads through email.

The infected email carries a fake 'From' address, picked up from the infected system.

The subject of the infected email will be any one of the following;

Re: <username> Your document
Re: <username> Your details
Re: <username> Requested file
Re: <username> Requested document
Re: <username> My information
Re: <username> My file
Re: <username> My document
Re: <username> My details
Re: <username> Information
Re: <username> Improved
Re: <username> Document
Re: <username> Details
Re: <username> Approved

(Where <user name> is taken from the gathered email addresses, which is usually the portion of the recipient's email address prior to @).

The body of the email will be any one of the following;

Your file <username> is attached.
Your document <username> is attached.
Your document <username> is attached to this mail.
See the file <username>.
Requested file <username>.
Please see the attached file <username> for details.
Please read the important message msg_<username>.
Please read the document <username>.
Please read the attached file <username>.
Please confirm the document <username>.
I have received your document. The improved document <username> is attached.
I have attached your document <username>.
Document <username>.
Details for <username>.
Authentification for <username> required.
<username> is attached.

(Where <user name> is taken from the gathered email addresses, which is usually the portion of the recipient's email address prior to @).

The infected email has an attachment with any one of the following names;

your_file_<username>.pif
your_document_<username>.pif
word_doc_<username>.pif
picture_<username>.pif
message_<username>.pif
improved_<username>.pif
file_<username>.pif
document_<username>.pif
doc_<username>.pif
details_<username>.pif
detailed_<username>.pif
articel_<username>.pif
<username>.pif

(Where <user name> is taken from the gathered email addresses, which is usually the portion of the recipient's email address prior to @).

Upon execution of the infected attachment, the worm copies itself as AVPROTECT9X.EXE in the Windows folder. It creates a mutex Rabbo_Mutex to check the presence of the worm in system memory.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.xml
.wsh
.wab
.vbs
.uin
.txt
.tbb
.shtm
.sht
.rtf
.pl
.php
.oft
.msg
.jsp
.html
.htm
.eml
.doc
.dhtm
.dbx
.cgi
.asp
.adb

This worm first appeared on March 10, 2004.

 Other names of W32/Netsky.M Worm:

This worm is also known as WORM_NETSKY.M, W32/Netsky-M, NetSky.M.