W32/Netsky.O Worm

 Information about the W32/Netsky.O worm:

W32/Netsky.O is a mass mailing worm. This worm is a variant of W32/Netsky. This worm infects Windows systems and spreads through email.

The infected email carries a fake 'From' address, picked up from the infected system.

The subject of the infected email will be any one of the following;

Re: Test
Re: Error
Re: Notify
Re: Status
Re: Failure
Re: Mail Server
Re: Bad Request
Re: SMTP Server
Re: Extended Mail
Re: Message Error
Re: Encrypted Mail
Re: Administration
Re: Delivery Server
Re: Secure delivery
Re: Delivery Protection
Re: Mail Authentification
Re: Thank you for delivery
Re: Extended Mail System
Re: Protected Mail System
Re: Protected Mail Request
Re: Secure SMTP Message
Re: Protected Mail Delivery

The body of the email will be a combination of Set1 and Set2

Set1:

You got a new message.
New message is available.
Please confirm my request.
Waiting for authentification.
Protected Mail System Test.
Partial message is available.
Please read the instructions.
Secure Mail System Beta Test.
Delivered message is attached.
Protected message is available.
Protected message is attached.
Encrypted message is available.
Forwarded message is available.
Now a new message is available.
For more details see the attachment.
For further details see the attachment.
Your requested mail has been attached.
First part of the secure mail is available.
You have received an extended message.
Please authenticate the secure message.
Follow the instructions to read the message.
SMTP: Please confirm the attached message.
Bad Gateway: The message has been attached.
Please read the attachment to get the message.
Waiting for a Response. Please read the attachment.
ESMTP [Secure Mail System #334]: Secure message is attached.

Set2:

+++ Attachment: No Virus found
+++ Norton AntiVirus - You are protected
+++ www.symantec.de

+++ Panda AntiVirus - You are protected
+++ Attachment: No Virus found
+++ www.pandasoftware.com

+++ Attachment: No Virus found
+++ Norman AntiVirus - You are protected
+++ www.norman.com

+++ Attachment: No Virus found
+++ F-Secure AntiVirus - You are protected
+++ www.f-secure.com

The infected email has an attachment with an extension .pif along with any one of the following names;

msg
data
details
readme
message
document

Upon execution of the infected attachment, the worm copies itself as AVBGLE.EXE in the Windows folder.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.pl
.rtf
.oft
.txt
.uin
.jsp
.tbb
.cgi
.sht
.vbs
.doc
.dbx
.asp
.adb
.php
.htm
.eml
.xml
.wab
.wsh
.msg
.html
.dhtm
.shtm

This worm first appeared on March 17, 2004.

 Other names of W32/Netsky.O Worm:

This worm is also known as WORM_NETSKY.O, W32/Netsky.o@MM, Worm/Netsky.O, NetSky.O.