Yet another NetSky worm variant - NetSky.H was found on 5th of
March 2004. This variant is very close to NetSky.G variant. It
spreads itself in e-mails as an executable attachment.
This worm contains another, but this time less insulting message
for the authors of Bagle and Mydoom. And like its previous
variants NetSky.H tries to uninstall Bagle worm variants from an
infected computer.
Disinfection
F-Secure provides the special disinfection utility to eliminate
Netsky.H worm infection. You can download this utility from our
ftp site:
The worm's file is a PE executable file 22528 bytes long, packed
with PE-Pack file compressor. The unpacked file's size is over 28
kilobytes.
On March 8th, 2004 the worm constantly beeps with PC speaker from
11:00 to 11:59. Below is the link to the WAV file with the sound
that the worm makes:
NetSky.H worm doesn't copy its files to shared folders.
Installation to system
When run, the worm installs itself to system. It copies its file
to Windows folder as MAJA.EXE and creates a startup key for this
file in System Registry:
The worm creates a mutex named "MI[SkyNet.cz]SystemsMutex" to
avoid running more than one instance of itself.
Spreading in e-mails
NetSky.H worm has its own SMTP engine that it uses to send emails
with infected attachments to all found e-mail addresses. The worm
uses different subjects, message body texts and attachment names
in its e-mails.
The worm scans all available drives except CD-ROM drives for
e-mails. It searches for e-mail addresses in files with the
following extensions:
The subject for infected messages is selected from the following
list:
Re: Samples
Re: Document
Re: Approved
Re: Here the file
Re: Yours
Re: Your file
Re: Your folder
Re: Your encrypted file
Re: Hi
Re: Hello
Re: Appending
Re: Index
Re: Your data
Re: Your application
Re: Part 2
Re: Part 3
Re: Secound Part
Re: Zipped folder
Re: My details
Re: Your details
Re: Your bill
Re: Your PIN
Re: Your TAN
Re: Your loveletter
Re: Your picture
Re: Your briefing
The message body text for infected messages is selected from the
following list:
Your document is attached.
Here is the file.
See the attached file for details.
Please have a look at the attached file...
Please read the attached file.
Your file is attached.
The attachment name for infected messages is selected from the
following list:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
KasperskyAv
Explorer
Taskmon
system.
msgsvr32
DELETE ME
service
Sentry
Windows Services Host
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
KasperskyAv
Explorer
OLE
Windows Services Host
d3dupdate.exe
au.exe
sysmon.exe
rate.exe
gouday.exe
sate.exe
ssate.exe
srate.exe
NetSky.H worm removes Registry keys of several Bagle worm
variants if it finds them on an infected computer. At least the
last 8 keys listed above belong to earlier Bagle variants.
