Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


NetSky.R


Aliases:


NetSky.R
W32/Netsky.R, I-Worm.Netsky.s, W32/Netsky.R@mm

Malware
Email-Worm
W32

Summary

The Netsky.R variant was discovered on March 31st, 2004. It's a stripped down version of NetSky.Q with around 80% of functionality in common with the previous variant.NetSky.R performs a DDoS against several websites.



Disinfection & Removal


Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.


Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:



Technical Details


System Infection

Upon execution the worm copies its dropper to the Windows Directory as 'PandaAVEngine.exe', which is added to the registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] =
   "PandaAVEngine" = "%WinDir%\PandaAVEngine.exe"

where %WinDir% represents Windows directory name.

The main DLL is placed to the same place with the filename 'temp09094283.dll'.

The worm removes several registry values that belong to other worms.


Email Propagation

When collecting addresses NetSky.R recursively searches through all hard drives and checks the content of files with the following extensions:

.adb
 .asp
 .cfg
 .cgi
 .dbx
 .dhtm
 .doc
 .eml
 .htm
 .html
 .jsp
 .mbx
 .mdx
 .mht
 .mmf
 .msg
 .nch
 .ods
 .oft
 .php
 .pl
 .ppt
 .rtf
 .sht
 .shtm
 .stm
 .tbb
 .txt
 .uin
 .vbs
 .wab
 .wsh
 .xls
 .xml

This variant of NetSky sends emails having the following subject:

Re: Document<random numbers>

Body:

Excuse me,
 the important document is attached,
 Yours sincerely

And attachment name:

Document<random numbers>.pif


Payloads

Between 11th and 17th of April, 2004 NetSky.R infected computers will perform a Distributed Denial-of-Service attack against the following sites:

www.keygen.us
 www.kazaa.com
 www.emule-project.net
 www.cracks.am
 www.emule.de







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.