W32/Netsky.Q Worm

 Information about the W32/Netsky.Q Worm:

W32/Netsky.Q is a mass mailing worm. This worm will infect Windows systems and spreads through email.

The worm exploits a vulnerability affecting Internet Explorer involving incorrect MIME Header, which allows the automatic execution of email attachments while an email is previewed or read.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The content and the subject of the email will be random. It carries an infected attachment with random filename with the any of the following extension:

.exe
.zip
.scr

Upon execution of the attachment, the worm copies itself as sysmonxp.exe and firewalllogger.txt in the Windows System folder.

It also alters the windows registry at the following location to load itself during next startup;

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propogate itself the worm scans all the files present in the infected system having the following extensions and collects all the available email addresses.

.pl
.rtf
.oft
.txt
.uin
.jsp
.tbb
.cgi
.xls
.sht
.cfg
.ppt
.vbs
.doc
.dbx
.asp
.adb
.php
.htm
.eml
.xml
.wab
.wsh
.msg
.mmf
.html
.dhtm
.shtm

The worm mails itself to these addresses using its own SMTP engine.

The worm does not mail itself to email addresses containing the following strings:

spam@
reports@
ntivir
noreply@
abuse@
@viruslis
@symantec
@spam
@sophos
@skynet
@pandasof
@norton
@norman
@microsof
@messagel
@mcafee
@kaspersky
@freeav
@fbi
@f-secur
@f-pro
@bitdefender
@avp
@antivi