Panda Software reports on the new Netsky.C worm
Posted on 26.02.2004
PandaLabs has detected the appearance of the new C variant of the Netsky worm (W32/Netsky.C.worm). This malicious code is very similar to its predecessor, Netsky.B, which is still causing a large number of incidents worldwide. In fact, Netsky.B has been the virus most frequently detected by the free online antivirus Panda ActiveScan over the last few days.

Netsky.C reaches computers in an e-mail message whose subject, message body and attached file are selected at random from a long list of options.

When the attached file is run, Netsky.C copies itself to all the disk drives on the computer under the name WINLOGON.EXE.

It spreads by sending itself out to all the e-mail address it finds in files with the extensions .eml, .txt, .php, .pl, .htm, .html, .vbs, .rtf, .uin, .asp, .wab, .doc, .adb, .tbb, .dbx, .sht, .oft, .msg, .shtm, .cgi, and .dhtm stored on the computer. It does this using its own SMTP engine.

The worm also copies itself under a wide range of names to all the folders on the computer whose name contains the sequence of letters 'shar'. By doing this, it can also spread through P2P file sharing applications like KaZaA.

Netsky.C has been designed to emit a specific sequence of sounds through the speakers of the affected computer between 06:00 a.m. and 08:59 a.m. on February 26.

Finally, this worm inserts several entries in the Windows Registry in order to ensure that it is run whenever the infected computer is started up. Similarly, it deletes any entries that may have been created by other malicious code such as Mydoom.A and Mimail.T


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th