a-squared Malware-Info

Name: Worm.Win32.NetSky.D

Beschreibung:

Symptoms:
Presence of the following file in Windows directory (%WINDIR%)
"winlogon.exe"

Presence of the following entry in "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" registry key:
"ICQ Net" = "winlogon.exe -stealth"

Technical description:
This variant of the NetSky worm (.D) spreads only via e-mail (in contrast
with previous versions, which spread through some P2P applications as well),
sending itself to e-mail addresses found in the infected computer.

The worm arrives in the following e-mail format:

Subject - randomly chosen from the following strings:
"Re: Re: Document"
"Re: Re: Thanks!"
"Re: Thanks!"
"Re: Your document"
"Re: Here is the document"
"Re: Your picture"
"Re: Re: Message"
"Re: Hi"
"Re: Hello"
"Re: Re: Re: Your document"
"Re: Here"
"Re: Your music"
"Re: Your software"
"Re: Approved"
"Re: Details"
"Re: Excel file"
"Re: Word file"
"Re: My details"
"Re: Your details"
"Re: Your bill"
"Re: Your text"
"Re: Your archive"
"Re: Your letter"
"Re: Your product"
"Re: Your website"

Body - randomly chosen from the following strings:
"Your document is attached."
"Here is the file."
"See the attached file for details."
"Please have a look at the attached file."
"Please read the attached file."
"Your file is attached."

Attached filename (and extension) - randomly chosen from the following strings:
"your_document.pif"
"your_document.pif"
"document.pif"
"message_part2.pif"
"your_document.pif"
"document_full.pif"
"your_picture.pif"
"message_details.pif"
"your_file.pif"
"your_picture.pif"
"document_4351.pif"
"yours.pif"
"mp3music.pif"
"application.pif"
"all_document.pif"
"my_details.pif"
"document_excel.pif"
"document_word.pif"
"my_details.pif"
"your_details.pif"
"your_bill.pif"
"your_text.pif"
"your_archive.pif"
"your_letter.pif"
"your_product.pif"
"your_website.pif"

When the user double-clicks the e-mail attachment, the worm does the following:

- copies itself to Windows directory (%WINDIR%) as "winlogon.exe";

- adds the following entry to "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
registry key:
"ICQ net" = "winlogon.exe -stealth",
(so it will be executed each time Windows starts up);

- disables some antivirus software and other known worms (such as Mydoom.A
and Mydoom.B) by deleting relevant registry keys;

- scans the infected computers for e-mail addresses in files whose extension
is one of the following:
".eml"
".txt"
".php"
".pl"
".htm"
".html"
".vbs"
".rtf"
".uin"
".asp"
".wab"
".doc"
".adb"
".tbb"
".dbx"
".sht"
".oft"
".msg"
".shtm"
".cgi"
".dhtm"

- creates and sends e-mails to these addresses with the above described format:

- On 01 mar. 2004, between 6:00 and 9:00 am (local time, not GMT) the worm
generates in the computer's speaker sounds with random tones and durations.


This variant (.D) uses an improved routine for sending itself through
e-mail, allowing it to be sent several times faster than previous
variants (.A - .C).

The worm avoids sending itself to addresses containing at least one of
the following strings:
"icrosoft"
"antivi"
"ymantec"
"spam"
"avp"
"f-secur"
"itdefender"
"orman"
"cafee"
"aspersky"
"f-pro"
"orton"
"fbi"
"abuse"
"messagelabs"
"skynet"

Source: BitDefender Virus-Info

Anleitung zum Entfernen von Worm NetSky D:

Um diese Malware-Infektion zu löschen, downloaden und installieren Sie bitte a-squared Anti-Malware. Führen Sie einen Scan aller Laufwerke durch und verschieben Sie gefundene Objekte in die Quarantäne.

Mehr Datails zu dieser Bedrohung:

Weiterführende Links:

Bei Google nach Worm NetSky D suchen
Bei Bing nach Worm NetSky D suchen
Bei Yahoo nach Worm NetSky D suchen

Wie schützt man sich am besten vor Worm NetSky D?

Wichtig!
Sie benötigen unbedingt eine Antivirensoftware, die nicht nur Infektionen löschen kann, sondern Ihren PC dauerhaft vor neuen Bedrohungen schützen kann. Nur so sind Sie sicher vor Datendiebstahl und unnötigem Ärger und Kosten durch Neu-Installationen des Betriebssystems.

Kaufen Sie am besten noch heute die vielfach ausgezeichnete Schutzsoftware a-squared Anti-Malware!

Nur 30 Euro für die Sicherheit Ihres Computers.

a-squared Anti-Malware online bestellen:

Vertrauen Sie nur auf die beste Schutzsoftware!

Testsieger!

Mehr unabhängige Testberichte von Anti-Malware Software