Skip to main content

Worm:W32/NetSky.L

Classification

Category:

Malware

Type:

Email-worm

Aliases:

  • NetSky.L
  • W32/Netsky.L
  • I-Worm.Netsky.l

Summary

Another Netsky variant discovered on March 10th 2004. It drops itself as AVprotect.exe to Windows directory.

Removal

Technical Details

This new variant is a stripped down version, just containing a minimum set of features and with no comments on the ongoing virus war.

It will create the following key to point to itself:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HtProtect" = %sysdir%\AVprotect.exe

And create a mutex named "Rabbo" so it's not run more than once.

Email Spreading

It will spread using any of the following subjects:

Re: Important Re: Your document Re: Your details Re: Approved

With message bodies from the list:

Your file is attached. Please read the document. Your document is attached. Please read the attached file. Please see the attached file for details.

And with attachment names from:

your_file_%s.pif details_%s.pif document_%s.pif

Where '%s' will be substituted by a text string.

Protect your devices from malware with F‑Secure Total

Protecting your devices from malicious software is essential for maintaining online security. F‑Secure Total makes this easy, helping you to secure your devices in a brilliantly simple way.

  • Award‑winning antivirus and malware protection

  • Online browsing, banking, and shopping protection

  • 24/7 online identity and data breach monitoring

  • Unlimited VPN service to safe­guard your privacy

  • Password manager with private data protection

Choose how many devices you want to protect to get started.

  • Free customer support

  • Cancel anytime

  • The trial does not obligate you to buy the product

After 30 days your subscription will renew automatically for one year at €69.99.

More Support

Community

Ask questions in our Community.

User guides

Check the user guide for instructions.

Contact Support

Chat with with or call an agent.

Submit a Sample

Submit a file or URL for analysis.