NetSky.AB worm was found on April 28th, 2004. This variant shares nearly 98% of its functionality with NetSky.AA.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The worm's file is a packed PE executable 17920 bytes long.
Upon execution NetSky.AB copies itself as 'csrss.exe' file to Windows folder and adds a startup key for this file into System Registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BagleAV" = "%WinDir%\csrss.exe"
where %WinDir% represents Windows folder name.
The worm scans all hard drives from C: to Z: to harvest email addresses. The worm looks for email addresses in files with the following extensions:
.eml .txt .php .cfg .mbx .mdx .asp .wab .doc .vbs .rtf .uin .shtm .cgi .dhtm .adb .tbb .dbx .pl .htm .html .sht .oft .msg .ods .stm .xls .jsp .wsh .xml .mht .mmf .nch .ppt
Netsky.AB worm ignores email addresses that contain any of the following strings:
icrosoft antivi ymantec spam avp f-secur itdefender orman cafee aspersky f-pro orton fbi abuse messagelabs skynet andasoftwa freeav sophos antivir iruslis
The worm composes emails with different subject and body texts. Here is the list of subject texts that the worm uses:
Correction Hurts Privacy Password Criminal Pictures Text Money Stolen Found Numbers Funny Only love? More samples Picture Letter Question Illegal
The worm uses one of the following text strings as body text for an infected message:
Please use the font arial! How can I help you? Still? I've your password. Take it easy! Why do you show your body? Hey, are you criminal? Your pictures are good! The text you sent to me is not so good! True love letter? Do you have no money? Do you have asked me? I've found your creditcard. Check the data! Are your numbers correct? You have no chance... Wow! Why are you so shy? Do you have more samples? Do you have more photos about you? Do you have written the letter? Does it hurt you? Please do not sent me your illegal stuff again!!!
Netsky.AB attaches its executable file to emails that it sends out. The attachment name is selected from the following variants:
corrected_doc.pif hurts.pif document1.pif passwords02.pif image034.pif myabuselist.pif your_picture01.pif your_text01.pif your_letter.pif your_bill.pif my_stolen_document.pif visa_data.pif pin_tel.pif your_text.pif loveletter02.pif all_pictures.pif your_letter_03.pif your_picture.pif abuses.pif