Worm:W32/NetSky.W

Classification

Malware

Email-Worm

W32

NetSky.W, W32/Netsky.W@mm, I-Worm.Netsky.o

Summary

NetSky.W worm variant was discovered on April 16th, 2004.Although it has been just discovered, this variant is much more similar to NetSky.P or NetSky.Q than to any of the later variants. In fact, its structure bears a striking resemblance to that of NetSky.P, so only some differences among them will be listed on this description.This variant does not spread through P2P networks, as NetSky.P does.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:

Find out more
Knowledge Base

Find the latest advice in our Community Knowledge Base.

Product Manual

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Installation to system

Upon execution Netsky.W copies itself as VisualGuard.exe file to the Windows folder. The worm adds a startup key for itself into System Registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetDy" = "%WinDir%\VisualGuard.exe"

where %WinDir% represents Windows folder name.

Additionally the worm drops the following files into Windows folder:

zipped.tmp
base64.tmp
zip1.tmp
zip2.tmp
zip3.tmp

Email Spreading

Most of the email spreading functionality is similar or identical to NetSky.P.

Deleting Registry keys and disinfecting Bagle worm

NetSky.W worm removes Registry keys of several Bagle worm variants if it finds them on an infected computer.

Date Created: -

Date Last Modified: -