F-Secure Virus Descriptions : NetSky.J

Summary

A new variant of Netsky worm - Netsky.J was found on March 8th, 2004.

Disinfection

F-Secure provides the special disinfection utility to eliminate Netsky.J worm infection. You can download this utility from our ftp site:

ftp://ftp.f-secure.com/anti-virus/tools/f-netsky.exe

ftp://ftp.f-secure.com/anti-virus/tools/f-netsky.zip

Disinfection instructions can be found here:

ftp://ftp.f-secure.com/anti-virus/tools/f-netsky.txt

System administrators who are using F-Secure Policy Manager, can distribute the tool as a JAR package automatically to all workstations.

System administrators can download the JAR version from:

http://www.europe.f-secure.com/tools/f-netsky.jar

ftp://ftp.europe.f-secure.com/anti-virus/tools/f-netsky.jar

Back to the Top

Detailed Description

Descriptions of all previous NetSky worm variants can be found here:

W32/NetSky.A@mm: http://www.f-secure.com/v-descs/moodown.shtml

W32/NetSky.B@mm: http://www.f-secure.com/v-descs/netsky_b.shtml

W32/NetSky.C@mm: http://www.f-secure.com/v-descs/netsky_c.shtml

W32/NetSky.D@mm: http://www.f-secure.com/v-descs/netsky_d.shtml

W32/NetSky.E@mm: http://www.f-secure.com/v-descs/netsky_e.shtml

W32/NetSky.F@mm: http://www.f-secure.com/v-descs/netsky_f.shtml

W32/NetSky.G@mm: http://www.f-secure.com/v-descs/netsky_g.shtml

W32/NetSky.H@mm: http://www.f-secure.com/v-descs/netsky_h.shtml

W32/NetSky.I@mm: http://www.f-secure.com/v-descs/netsky_i.shtml

The worm's file is a PE executable file 27648 bytes long.

NetSky.J worm has a few modifications comparing to previous variants:

-The worm uses a different mutex: "SkYnEt_AVP"

-The worm has message for Bagle And Mydoom worm authors in the same lines as previous ones.

-The worm uses the following subject texts:

 Your product
 Your letter
 Re: corrected homework
 Re: I've found your document
 Re: Your bill
 Re: hello again
 Re: hi again
 Re: part 3
 Re: important document part 2
 Re: important
 Re: Your data
 Re: Your application
 Re: your music
 Re: excel document
 Re: Re: Re: word document
 Re: Your details
 Re: My details
 Re: Your requested file
 Re: Read it immediately
 Re: Approved
 Re: Your software
 Re: my memberlist
 Re: Your document
 Re: Your file
 Re: Your important document
 www.%s.tripod.com
 Hi Mr. %s
 Moi %s
 He %s
 Yours faithfully, %s
 Message to %s
 Hi Mrs. %s
 Is %s.doc yours?
 Is %s.xls yours?
 Whats up %s
 www.paypal.com/%s
 Na %s
 Best %s
 Love %s
 Good morning %s
 Have a good day %s
 Dear %s
 To %s , it's me
 Welcome %s
 Moin %s
 Hello %s
 Your account %s is expired!
 Hey %s
 Hi %s
 www.%s.freepage.com, your website
 Hi %s, your product
 Hello %s, your letter
 Re: Hi %s, your archive
 Re: %s, your text
 Re: Hello %s, your bill
 Re: Hi %s, your details
 Re: Hello %s, my details
 Re: Hi %s, your word file
 Re: Hello %s, your excel file
 Re: Hi %s, details
 Re: Hello %s, Approved
 Re: Hello %s, your software
 Re: Hi %s, your music
 Re: Dear %s, Here
 Re: Re: Re: Hello %s, your document
 Re: Hi %s
 Re: Dear %s, Hi
 Re: Re: Hi %s,  your message
 Re: Here %s, your picture
 Re: Hi %s, here is the document
 Re: Hello %s, your document
 Re: %s, thanks!
 Re: Re: %s, thanks!
 Re: Re: Hi %s, document
 Re: Hello %s, document