Threat Description

NetSky.W

Details

Aliases:NetSky.W, W32/Netsky.W@mm, I-Worm.Netsky.o
Category:Malware
Type:Email-Worm
Platform:W32

Summary



NetSky.W worm variant was discovered on April 16th, 2004.Although it has been just discovered, this variant is much more similar to NetSky.P or NetSky.Q than to any of the later variants. In fact, its structure bears a striking resemblance to that of NetSky.P, so only some differences among them will be listed on this description.This variant does not spread through P2P networks, as NetSky.P does.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.

Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:



Technical Details



Installation to system

Upon execution Netsky.W copies itself as VisualGuard.exe file to the Windows folder. The worm adds a startup key for itself into System Registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "NetDy" = "%WinDir%\VisualGuard.exe"

where %WinDir% represents Windows folder name.

Additionally the worm drops the following files into Windows folder:

zipped.tmp
 base64.tmp
 zip1.tmp
 zip2.tmp
 zip3.tmp

Email Spreading

Most of the email spreading functionality is similar or identical to NetSky.P.

Deleting Registry keys and disinfecting Bagle worm

NetSky.W worm removes Registry keys of several Bagle worm variants if it finds them on an infected computer.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More