[DMCForum] New Worm (virus) Outbreak - Netsky.B
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[DMCForum] New Worm (virus) Outbreak - Netsky.B
- From: "Dave Stragand" <dave.stragand@xxxxxxxxxxxxxxx>
- Date: Wed, 18 Feb 2004 16:31:57 -0500
I've gotten this in my mailbox about 10 times in the last four hours, so
keep an eye out. As always, if you're not expecting an attachment from
someone, DON'T OPEN IT!
-Dave
http://story.news.yahoo.com/news?tmpl=story
<http://story.news.yahoo.com/news?tmpl=story&cid=582&e=1&u=/nm/20040218/wr_n
m/tech_worm_netskyb_dc>
&cid=582&e=1&u=/nm/20040218/wr_nm/tech_worm_netskyb_dc
SEATTLE (Reuters) - A new worm called "Netsky.B" emerged on the Internet on
Wednesday, spreading by mimicking familiar e-mail addresses and enticing
users to open file attachments containing malicious software, security
experts said.
Most computer security companies rated the worm a medium-grade threat,
describing it more of an annoyance rather than a malicious virus that
destroys files or makes computer vulnerable to attacks.
"It's a very low infection rate virus," said David Perry, global education
director at Trend Micro Inc., adding that newer, more infectious versions
could be in the pipeline.
The worm, once activated, forwards itself to e-mail addresses found on an
infected computer's hard drive.
Netsky.B usually arrives in e-mail boxes appearing as e-mail from a familiar
person with an attachment that appears to be a Microsoft Word document with
the words "read it immediately" or "something for you" making it tricky to
identify.
Anti-virus software and services provider Network Associates Inc. said the
worm's activity appeared to be concentrated in Europe, particularly the
Netherlands.
Both businesses and consumers were being hit by the fast-spreading worm.
<http://vil.nai.com/vil/content/v_101034.htm>
http://vil.nai.com/vil/content/v_101034.htm
The virus may be received in an email message as follows:
From: (forged address taken from infected system) or skynet@xxxxxxxxx
Subject: (one of the following)
* fake
* for
* hello
* hi
* immediately
* information
* it
* read
* something
* stolen
* unknown
* warning
* you
Body : (one of the following)
* about me
* anything ok?
* do you? that's funny
* from the chatter
* greetings
* here
* here is the document.
* here it is
* here, the cheats
* here, the introduction
* here, the serials
* i found this document about you
* I have your password!
* i hope it is not true!
* i wait for a reply!
* i'm waiting ok
* information about you
* is that from you?
* is that true?
* is that your account?
* is that your name?
* kill the writer of this document!
* my hero
* read it immediately!
* read the details.
* reply
* see you
* something about you!
* something is fool
* something is going wrong
* something is going wrong!
* stuff about you?
* take it easy
* that is bad
* thats wrong why?
* what does it mean?
* yes, really?
* you are a bad writer
* you are bad
* you earn money
* you feel the same
* you try to steal
* your name is wrong
Attachment: (one of the following names)
* aboutyou
* attachment
* bill
* concert
* creditcard
* details
* dinner
* disco
* doc
* document
* final
* found
* friend
* jokes
* location
* mail2
* mails
* me
* message
* misc
* msg
* nomoney
* note
* object
* part2
* party
* posting
* product
* ps
* ranking
* release
* shower
* story
* stuff
* swimmingpool
* talk
* textfile
* topseller
* website
May be followed by:
* .doc
* .htm
* .rtf
* .text
Followed by:
* .com
* .exe
* .pif
* .scr
The attachment may have a double-extension, such as .rtf.pif, and may be
contained in a .ZIP file.
The mailing component harvests address from the local system. Files with
the following extensions are targeted:
* .adb
* .asp
* .dbx
* .doc
* .eml
* .htm
* .html
* .msg
* .oft
* .php
* .pl
* .rtf
* .sht
* .tbb
* .txt
* .uin
* .vbs
* .wab
The virus sends itself via SMTP - constructing messages using its own SMTP
engine. It queries the DNS server for the MX record and connects directly to
the MTA of the targeted domain and sends the message.
System changes
When executed, a fake error message may be displayed.
The worm copies itself into %windir% folder using the filename SERVICES.EXE.
A registry run key is created to load the worm at system start.
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "service" = C:\WINNT\services.exe -serv
Network propagation/Peer to Peer propagation
The worm copies itself to directories named share or sharing on the local
system and on mapped network drives. This will result in propagation via
KaZaa, Bearshare, Limewire, and other P2P application that use shared folder
names containing the words share or sharing. The filenames are included in
the worm and chosen randomly:
* angels.pif
* cool screensaver.scr
* dictionary.doc.exe
* dolly_buster.jpg.pif
* doom2.doc.pif
* e.book.doc.exe
* e-book.archive.doc.exe
* eminem - lick my pussy.mp3.pif
* hardcore porn.jpg.exe
* how to hack.doc.exe
* matrix.scr
* max payne 2.crack.exe
* nero.7.exe
* office_crack.exe
* photoshop 9 crack.exe
* porno.scr
* programming basics.doc.exe
* rfc compilation.doc.exe
* serial.txt.exe
* sex sex sex sex.doc.exe
* strippoker.exe
* virii.scr
* win longhorn.doc.exe
* winxp_crack.exe
The worm also drops numerous ZIP files containing the worm (22,016 bytes).
The compressed file frequently uses a double extension like .doc.pif,
.rtf.com, .rtf.scr). The list of ZIP names is hardcoded in the virus body:
* aboutyou.zip
* attachment.zip
* bill.zip
* concert.zip
* creditcard.zip
* details.zip
* dinner.zip
* disco.zip
* final.zip
* found.zip
* friend.zip
* jokes.zip
* location.zip
* mail2.zip
* mails.zip
* me.zip
* message.zip
* misc.zip
* msg.zip
* nomoney.zip
* note.zip
* object.zip
* part2.zip
* party.zip
* posting.zip
* product.zip
* ps.zip
* ranking.zip
* release.zip
* shower.zip
* story.zip
* stuff.zip
* swimmingpool.zip
* talk.zip
* textfile.zip
* topseller.zip
* website.zip
Mydoom virus removal
The virus removes the following registry values to deactivate Mydoom.a and
Mydoom.b.
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run Taskmon
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run Explorer
* HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run Taskmon
* HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run Explorer
*
HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer3
2
Other registry keys removed are as follows:
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run KasperskyAv
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run system.
[Non-text portions of this message have been removed]
Yahoo! Groups Links
Back to the Home of PROJECT VIXEN