Virus library
Knowledge database

Win32.HLLM.Netsky

(W32/Patched.AF, W32/Resourcer, Possible_Mlwr-13, Generic.dx, TR/Patched.AF.56, Virus:Win32/Resourcer.A, TR/Crypt.UPKM.Gen, WORM_NETSKY.Z, W32.Netsky.AN@mm, Trojan-Proxy.Win32.Agent.da, WORM_NETSKY.BI, PE_RESOURCER.A, WORM_NETSKY.GEN, Trojan.Win32.Patched.af, W32/Netsky.c@MM, Win32/PEPatch, W32/Buchon!keylog, Email-Worm.Win32.NetSky.aa, W32/Sality.x, Trojan.Agent.XX, Win32.Netsky.AA@mm, Worm/Netsky.AH)

Virus Type: Mass mailing worms.

Affected OS: Win95/98/Me/2000/XP

Size: can be 25 352 byte, 17 424 byte, 24 840 byte, 22 016 byte, 18 944 byte, 31 232 byte

Packed by: can be packed by PETITE, PEPACK, PCPEC, UPX, PECOMPACT

Technical Information

  • For providing unattended startup of its copies during each Windows reboot, various worm modifications can insert data

    C:\Windows\winlogon.exe -stealth ,
    C:\Windows\MsnMsgrs.exe -alev ,
    C:\Windows\fooding.exe –antivirus

    into HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ of registry.

  • Worm extracts addresses for email distribution out of files with the following extensions:

    .dhtm
    .cgi
    .shtm
    .msg
    .oft
    .sht
    .dbx
    .tbb
    .adb
    .doc
    .wab
    .asp
    .uin
    .rtf
    .vbs
    .html
    .htm
    .pl
    .php
    .txt
    .eml

  • For spreading due file exchange networks worms copy themselves in general folders with the following filenames:

    The Sims 3 crack.exe
    Lightwave SE Update.exe
    Ulead Keygen.exe
    Smashing the stack.rtf.exe
    IE58.1 full setup.exe
    Opera.exe
    DivX 7.0 final.exe
    WinAmp 12 full.exe
    Cracks & Warez Archive.exe
    Visual Studio Net Crack.exe
    ACDSee 9.exe
    MS Service Pack 5.exe
    Clone DVD 5.exe
    Magix Video Deluxe 4.exe
    Star Office 8.exe
    Partitionsmagic 9.0.exe
    Gimp 1.5 Full with Key.exe
    Norton Antivirus 2004.exe
    Windows Sourcecode.doc.exe
    Keygen 4 all appz.exe
    3D Studio Max 3dsmax.exe
    1000 Sex and more.rtf.exe
    RFC Basics Full Edition.doc.exe
    Dictionary English - France.doc.exe
    Win Longhorn Beta.exe
    WinXP eBook.doc.exe
    Learn Programming.doc.exe
    How to hack.doc.exe
    Doom 3 Beta.exe
    E-Book Archive.rtf.exe
    Virii Sourcecode.scr
    Ahead Nero 7.exe
    Full album.mp3.pif
    Screensaver.scr
    Serials.txt.exe
    Microsoft Office 2003 Crack.exe
    XXX hardcore pic.jpg.exe
    Dark Angels.pif
    Porno Screensaver.scr
    Best Matrix Screensaver.scr
    Adobe Photoshop 9 full.exe
    Adobe Premiere 9.exe
    Teen Porn 16.jpg.pif
    Microsoft WinXP Crack.exe

  • Subjects of distributed messages are selected from the following list. Most often one can find messages notifying that user's email address is deactivated or closed and it's suggested to user to learn details:
    Your mail account expired. Please follow the link to reactivate.
    Your mail account has been closed. Click on the link for further details.
    Your mail account has been deactivated. To reactivate, follow the link.
    Mail account expired
    Mail account closed
    Mail account deactivated
    Your file is attached.
    Please read the attached file.
    Please have a look at the attached file.
    See the attached file for details.
    Here is the file.
    Your document is attached.
    me veja peladinha
    gostaria disso e voce???
    algo a mais falea verdade!!!
    ganhe muita grana
    campanhadafome
    pq nao me liga??
    sinto voce!!
    grana
    Lembra? amor me liga
    Hackers do Brasil
    Medical Labs Exames!!!
    meu telefone liga
    ferias nos E.U.A
    Surto :(
    Vacina contra o HIV!!
    sua conta bancaria zerada
    olha que isso!!!
    parabens!
    te amo!
    Policia SP
    Sua Conta!!
    Boleto Pague
    veja o que tem no zip e me liga receitas de bolo!!
    acrdito que em voce!!!
    promocao de viajens de fim de ano
    tudo sobre voce sabe
    Proposta de emprego!!
    estou doente veja!!!
    me diz o queacha?
    retorna logo isso!!
    arquivo zipado PGP???
    voce passou
    :D!!!
    ve ai logo ta
    AMA!
    AmaVoce
    Abra rapido isso!!!!
    reza de sao tome!!!!.
    veja detalhes!!!.
    encontro voce!
    preenche ai ta bom
    PizzaVeneza!
    vaca
    tetas
    war3!
    AIDS!
    grana
    banco!
    revista lulao!
    imposto jogo!
    loterias
    vips!
    missao
    vadias!
    email
    flipe
    botao
    sampa!!
    contas!!
    zerado
    :(
    criancas!
    brasil!
    lantrocidade
    aqui
    docs
    festa!!
    LINUSTOR
    bingos!
    agua!
    :D
    sorteado!!
    grana!!
    dinheiro!!
    carros!
    voce
    :-)
    ???
    circular
    agradou
    diga
    robos!
    impressao!!
    massas!
    pescaria por kilo
    Sua saude esta bem? morto :)

  • Worm copies, which are attached to message body, can be either with single or double extension. Examples:
    • your_website.pif
    your_product.pif
    your_letter.pif
    your_archive.pif
    your_text.pif
    your_bill.pif
    your_details.pif
    document_word.pif
    document_excel.pif
    my_details.pif
    all_document.pif
    application.pif
    mp3music.pif
    yours.pif
    document_4351.pif
    your_file.pif
    message_details.pif
    your_picture.pif
    document_full.pif
    message_part2.pif
    document.pif
    your_document.pif
    vota!.zip.scr
    aninha gatinha!.zip.scr
    importante!!!!!.zip.scr
    minhavida!.zip.exe
    comoserrico!.zip.scr
    vida!!.zip.scr
    receitas de bolo!!.zip.scr
    celulares!!.zip.scr
    clica ai logo meu.scr
    rede globo tv!.zip.scr
    rocha.scr
    paula!.scr
    Carnaval em Salvador!!.zip.scr
    vadias peladas!!.scr
    cafe!!.zip.scr
    traficoemSP!.scr
    MulataDandoOcujpg.scr
    multas.pif
    caspa.scr
    barrio.scr
    ResidentEvil2.zip.scr
    puteiros!!.scr
    Canaval2004!.jpg.pif
    VivaNaBaia!.scr

  • Worms don’t perform spreading to the addresses, which contain following substring:
    abuse
    fbi
    orton
    f-pro
    aspersky
    cafee
    orman
    itdefender
    f-secur
    avp
    spam
    ymantec
    antivi
    icrosoft
    iruslis
    andasoftwa
    skynet

  • Delete all keys (and their data) which are listed below:
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KasperskyAV
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Taskmon
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\msgsvr32
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\service
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OLE
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Sentry
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Host HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
      HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
      HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\DELETE ME
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\au.exe
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run\d3dupdate.exe
      HKLM\System\CurrentControlSet\Services\WksPatch

  • Can contain in their body IP-addresses of German, Swiss and Dutch sites, which are holding DoS-attacks.

  • Can contain text string of expressive nature, which are addressed to authors of email worms families - MyDoom and Beagle. For example:

    Hey Bagle, feel our revenge!
    MyDoom and Bagle are spammer we are the skynet - you can't hide yourself! - we kill malware writers (they have no chance!) - [LaMeRz-->]MyDoom.F is a thief of our idea! - -< SkyNet AV vs. Malware >- ->->

    • System Recovery Information
    1. Load Windows in Safe Mode.
    2. Scan computer with Dr.Web® Scanner or freeware utility Dr.Web® CureIT!. It's necessary to apply action "Cure" to all infected files which were found.
    3. Recover system registry from backup copy.

    Important! Directly before doing of item 2, it's necessary to adjust the used email client so that it stored attachments as separate files, instead of in a body of email base. For example, storage of attachments separately from email base in email client TheBat! is adjusted as follows:
    Account - Properties - Files & Directories - Keep attachment files - Separately in a special directory.

    System recover recommendations

    1. Reboot Windows in Safe Mode.
    2. Use Dr.Web® scanner of free curing utility Dr.Web® CureIT! to scan local drives. The “Cure” action should be applied for all infected files.
    3. Restore registry from the backup copy.

    Important! Before following these recommendations you should set up the mail client you use so that it stores attachments as separate files and not in the body of the database. For example, such storage in TheBat! is enabled as follows: Account — Properties — Files & Directories — Keep attachment files — Separately in a special directory.
    Last updated: 2010-02-10 04:42:40 MSK
    Total records in virus database: 1030242

    Top virus chart

    Trojan.DownLoad.372368.61%
    Win32.HLLM.Netsky.353287.91%
    Win32.HLLM.MyDoom.496.54%
    Trojan.DownLoad.472566.52%
    Win32.HLLM.MyDoom.445.99%

    Search in virus database

    Company | News&Events | Send a virus | Online scanner | Privacy policy | Site map More www-resources:
    www.av-desk.com
    www.freedrweb.com
    www.drweb-curenet.com    		 pda.drweb.com
    estore.drweb.com

    Doctor Web ©
    2003 — 2010

    Doctor Web is a Russian IT-security solutions vendor. Dr.Web anti-virus software has been developed since 1992. The leader on the Russian IT security services market, Doctor Web has been the first vendor that offered an anti-virus as a service in Russia. The company also offers proven anti-virus and anti-spam solutions for businesses, government entities, and personal use. We have a solid record of detecting malicious programs, and we adhere to all international security standards. Doctor Web has received numerous certificates and awards; our satisfied customers spanning the globe are clear evidence of the complete trust customers have in our products.