[ news_security_news ]
Netsky.ag@MM Virus Assessed As Medium Risk
SecurityProNews
Staff Writer
2004-10-15
 Security News RSS Feed
McAfee AVERT raised the risk assessment to Medium on the recently discovered W32/Netsky.ag@MM, also known as Netsky.ag.
This new variant is a prolific worm that spreads via email, sending itself to addresses found on the victim's machine. McAfee AVERT researchers have received over 100 samples of Netsky.ag from both real customer submissions and virus-generated mail -- with most of the samples reported to be from Brazil and Argentina.
Threat Overview
Netsky.ag is a mass mailing threat that contains its own SMTP engine to construct outgoing messages. It harvests addresses from local files and then uses the harvested addresses in the "From" field to send itself. This produces a message with a spoofed From address. When run, the worm displays a message box, "File corrupted replace this!" Users should be very wary and should most likely delete any email containing the following:
From: (address is spoofed)
Subject: (one of the following)
-- 0123456789
-- Abra rapido isso!!!!
-- acrdito que em voce!!!
-- algo a mais
-- AmaVoce
-- amor me liga
-- AninhaPutinha +55operado6992292246
-- arquivo zipado PGP???
-- Boleto Pague
-- campanhadafome
-- encontro voce!
-- estou doente veja!!!
-- falea verdade!!!
-- ferias nos E.U.A
-- ganhe muita grana
-- gostaria disso e voce???
-- grana
-- Hackers do Brasil
-- Lembra?
-- me diz o queacha?
-- me veja peladinha
-- Medical Labs Exames!!!
-- meu telefone liga
-- olha que isso!!!
-- parabens!
-- PizzaVeneza!
-- Policia SP
-- pq nao me liga??
-- preenche ai ta bom
-- promocao de viajens de fim de ano
-- Proposta de emprego!!
-- receitas de bolo!!
-- retorna logo isso!!
-- reza de sao tome!!!!.
-- sinto voce!!
-- sua conta bancaria zerada
-- Sua Conta!!
-- Surto :(
-- te amo!
-- tudo sobre voce sabe
-- Vacina contra o HIV!!
-- ve ai logo ta
-- veja detalhes!!!.
-- veja o que tem no zip e me liga
-- voce passou :D!!!
Body Text: (one of the following)
-- PizzaVeneza!
-- preenche ai ta bom
-- encontro voce!
-- veja detalhes!!!.
-- reza de sao tome!!!!.
-- Abra rapido isso!!!!
-- AmaVoce
-- AMA!
-- ve ai logo ta
-- voce passou :D!!!
-- arquivo zipado PGP???
-- retorna logo isso!!
-- me diz o queacha?
-- estou doente veja!!!
-- Proposta de emprego!!
-- tudo sobre voce sabe
-- promocao de viajens de fim de ano
-- acrdito que em voce!!!
-- receitas de bolo!!
-- veja o que tem no zip e me liga
-- Boleto Pague
-- Sua Conta!!
-- Policia SP
-- te amo!
-- parabens!
-- olha que isso!!!
-- sua conta bancaria zerada
-- Vacina contra o HIV!!
-- Surto :(
-- ferias nos E.U.A
-- meu telefone liga
-- Medical Labs Exames!!!
-- Hackers do Brasil
-- amor me liga
-- Lembra?
-- grana
-- sinto voce!!
-- pq nao me liga??
-- vaca
-- campanhadafome
-- ganhe muita grana
-- falea verdade!!!
-- algo a mais
-- gostaria disso e voce???
-- me veja peladinha
Threat Pathology
Netsky.ag copies itself to local folders containing string share or sharing, network shares and P2P shared folders. After being executed, the worm copies itself into the Windows System directory (%WinDir%MsnMsgrs.exe). The following Registry key is added to hook system startup:
-- HKEY_LOCAL_MACHINESoftwareMicrosoft
WindowsCurrentVersionRun "MsnMsgr" = %WinDir%MsnMsgrs.exe -alev
The worm then emails itself to addresses found on the infected host as a .PIF, .COM, .SCR, .BAT, or .ZIP file.
System Protection and Cure
More information on Netsky.ag and cure for this worm can be found online at the McAfee AVERT site. McAfee AVERT is advising its customers to update to the 4399 DATs to stay protected from all the current Netsky threats.
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More news_security_news Articles
Security News RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
