W32/Netsad.B Worm

 Information about the W32/Netsad.B Worm:

W32/Netsad.B is an email worm. The worm will infect Windows systems. The worm spreads through email and P2P networks.

The 'From' address of the infected email will be any one of the following;

YourFriend@yahoo.com
update@yahoo.com
ted@yahoo.com
symantec@yahoo.com
steve@yahoo.com
stan@yahoo.com
smith@yahoo.com
pic@yahoo.com
password@yahoo.com
panda@yahoo.com
nod32@yahoo.com
mcafee@yahoo.com
matt@yahoo.com
mail@yahoo.com
LongShot@yahoo.com
info@yahoo.com
ebook@yahoo.com
bob@yahoo.com
bill@yahoo.com
avg@yahoo.com

The 'Cc' address of the infected email will be;

info@yahoo.com

The 'Bcc' address of the infected email will be;

password@yahoo.com

The subject of the infected email will be any one of the following;

NOD32
Yahoo!
mcafee
Norton!
symantec
Pentru Ionel
IranSare2008
Fax Message
Important bill!
Text message
Account notify
E-mail warning
Message Notify
Cum a murit Papa?
Protected message
Encrypted document
Fax Message Received
Email account utilization warning.
E-mail technical support message.
E-mail account disabling warning

The body of the infected mail will be any one of the following;

Message Error
you know amir_civil?!
old photos about you?
i hope thats not true!
kindness is a virtue...
nice stuffs i got here...
classroom test of you?
the information is wrong!
i've got cool stuffs here...
another pic, have fun! ... :->
hello! i'm your long, lost friend...
i want you to know how much i care for you...
Ioana, sex in grup in camin. Cred ca o stii si
sharing files is the essence of living... check this out...
three files for you to keep... always remember that i'm into deep... i don't know you but i think i'm in love...
one of the files is a virus... can you tell me which one is it? hehehe, i'm only joking... your friend, paul..
hmmmn... i guess you've forgotten me... but anyways, i wanna make up... here are the files that made me like the internet more... see for yourself...
hi, friend... here are some nice stuffs that i got from the internet... check it out...
Credeti ca ar fi mai bine ca Romania sa-si retraga trupele din Irak anul acesta?Deschideti programul Vot, alegeti votul dvs. si vedeti rezultatele.Parerea dvs. conteaza!
Credeti ca ar fi mai bine ca Romania sa-si retraga trupele din Irak anul acesta?Deschideti programul Vot, alegeti votul dvs. si vedeti rezultatele.Parerea dvs. conteaza!

The name of the infected attachment will be any one of the following;

register.pif
readme.html.cmd
fullmessenger.exe
AmirCivil.pic.cmd
sexy-screensaver.scr

Upon execution of the infected attachment, the worm copies itself as WINSERVICCES.CAB.BAK.EXE in the Windows System folder.

It also drops a copy of itself with any of the following file names in all logical drives present on the infected system:

avg.pif
vista.exe
Nod32.cmd
winamp.exe
Mcafee.exe
Norton.exe
Services.pif
mail.dll.exe
AmirCivil.pif
ScreenSaver.scr

It alters the windows registry at the following location to load itself during next startup;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm copies all available email address from the files having following extensions:

.HTML, .TXT, and .XML

The worm mails itself to these addresses using SMTP server mx4.mail.yahoo.com

The worm propogates through P2P software by copying itself to the shared folders used by P2P software having the following names.

eMule
Kazaa
Gnucleus
Morpheus

It also tries to terminate some of the security related processes.

This worm first appeared on June 30, 2006.

 Other names of W32/Netsad.B Worm:

This Worm is also known as WORM_NETSAD.B .