W32/Netsky.T Worm

 Information about the W32/Netsky.T worm:

W32/Netsky.T is a mass mailing worm. This worm is a variant of W32/Netsky.This worm infects Windows systems and spreads through email.

The infected email carries a spoofed 'From' address, picked up from the infected system.

The subject of the infected email will be any one of the following;

Your information
Your document
Your details
Thank you!
Request
Re: Your information
Re: Your document
Re: Your details
Re: Thanks you!
Re: Request
Re: My details
Re: Important
Re: Hi
Re: Hello
Re: Approved
My details
Important
Hello!
Hello
Approved

The body of the email will be a combination of the following sets;

Set 1:

Hi!
Hello!

Set 2:

I have spent much time for the <random sting>.
I have sent the <random sting>.
I have found the <random sting>.
Your file is attached to this mail.
My <random sting>.
My <random sting>is attached.
I have spent much time for your document.
Your <random sting>. ·Your <random sting>is attached.
The requested <random sting>is attached!
The <random sting>.
The <random sting>is attached.
See the document for details.
Please notice the attached document.
Please notice the attached <random sting>.
Please have a look at the attached document.
Please have a look at the <random sting>.
Note that I have attached your document.
Here is the document. ·Here is the <random sting>.
For more information see the attached document.
For more details see the attached document.
Approved, here is the document.
Please, <random sting>.
Please see the <random sting>.
Please read the attached document.
Please read the <random sting>.
Please read quickly.

Set 3:

Yours sincerely
Thanks
Thank you

The infected email attachment will be a random string followed by a random number with .pif extension.

Upon execution of the infected attachment, the worm copies itself as EASYAV.EXE in the Windows folder. The worm also creates a file UINMZERTINMDS.OPM in the Windows folder. It creates the following mutex to check if the worm is already in memory:

Protect_USUkUyUnUeUtU_Mutex
SyncMutex_USUkUyUnUeUtU

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.pl, .rtf, .oft, .txt, .uin, .jsp, .tbb, .cgi, .sht, .vbs, .doc, .dbx, .asp, .adb, .php, .htm, .eml, .xml, .wab, .wsh, .msg, .html, .dhtm, .shtm

The worm mails itself to these addresses using its own SMTP engine.

The worm opens port 6789 to allow access to the infected system.

This worm first appeared on April 6, 2004.

 Other names of W32/Netsky.T Worm:

This worm is also known as WORM_NETSKY.T, W32/Netsky.t@MM, Netsky.T, W32/Netsky.T.worm, W32.Netsky.T@mm.

Download the FREE Evaluation copy of Protector Plus antivirus software