Threat Description

NetSky.W

Details

Category: Malware
Type: Email-Worm
Platform: W32
Aliases: NetSky.W, W32/Netsky.W@mm, I-Worm.Netsky.o

Summary


NetSky.W worm variant was discovered on April 16th, 2004.Although it has been just discovered, this variant is much more similar to NetSky.P or NetSky.Q than to any of the later variants. In fact, its structure bears a striking resemblance to that of NetSky.P, so only some differences among them will be listed on this description.This variant does not spread through P2P networks, as NetSky.P does.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:



Technical Details


Installation to system

Upon execution Netsky.W copies itself as VisualGuard.exe file to the Windows folder. The worm adds a startup key for itself into System Registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]  "NetDy" = "%WinDir%\VisualGuard.exe"  

where %WinDir% represents Windows folder name.

Additionally the worm drops the following files into Windows folder:

zipped.tmp  base64.tmp  zip1.tmp  zip2.tmp  zip3.tmp  
Email Spreading

Most of the email spreading functionality is similar or identical to NetSky.P.

Deleting Registry keys and disinfecting Bagle worm

NetSky.W worm removes Registry keys of several Bagle worm variants if it finds them on an infected computer.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More