Alias:Moodown.B
Type:Worm 
Size:22,016 bytes 
Origin:unknown 
Date:02-18-2004 
Damage:Sends itself as email 
VDF Version:6.24.00.09 
Danger:Low 
Distribution:Medium 

General DescriptionWorm/NetSky.B is a pure massmailer, which has a file size of 22016 bytes and is packed with UPX.

Symptoms* When launched, a fake message with the following text will be generated:
"The file could not be opened!"

Distribution* Sends itself as email
* Copies itself in shared folders

Technical DetailsWorm/NetSky.B has a size of 22.016 bytes and is packed with UPX. If it's executed, the worm copies itself into the Windows folder using the file name SERVICES.EXE. Subsequently, the worm creates the following entry in registry:

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run]
"service"="C:\\WINDOWS\\services.exe serv"

The worm will delete the registry entries which have one of the following values:

* [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Taskmon"
"Explorer"
"system."
"KasperskyAv"

* [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Taskmon"
"Explorer"

* [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"system."

Worm/NetSky scans files with the following file extensions for email addresses:

* msg
* oft
* sht
* dbx
* tbb
* adb
* doc
* wab
* asp
* uin
* rtf
* vbs
* html
* htm
* pl
* php
* txt
* eml

If the worm finds a folder containg the strings "Share" or "sharing", it copies itself into this with the following file names:

* winxp_crack.exe
* dolly_buster.jpg.pif
* strippoker.exe
* photoshop 9 crack.exe
* matrix.scr
* porno.scr
* angels.pif
* hardcore porn.jpg.exe
* office_crack.exe
* serial.txt.exe
* cool screensaver.scr
* eminem - lick my pussy.mp3.pif
* nero.7.exe
* virii.scr
* e-book.archive.doc.exe
* max payne 2.crack.exe
* how to hack.doc.exe
* programming basics.doc.exe
* e.book.doc.exe
* win longhorn.doc.exe
* dictionary.doc.exe
* rfc compilation.doc.exe
* sex sex sex sex.doc.exe
* doom2.doc.pif

If a connection to the internet is active, the worm sends itself as EXE or as ZIP archives. If it sends itself as ZIP archives, then it generates the file names from the following words:

* document
* msg
* doc
* talk
* message
* creditcard
* details
* attachment
* me
* stuff
* posting
* textfile
* concert
* information
* note
* bill
* swimmingpool
* product
* topseller
* ps
* shower
* aboutyou
* nomoney
* found
* story
* mails
* website
* friend
* jokes
* location
* final
* release
* dinner
* ranking
* object
* mail2
* part2
* disco
* party
* misc

The first file extension of the attached file will be chosen from:

* txt
* rtf
* doc
* htm

and as the second file extension will be either exe, scr, com or pif.

The subject of the sent email is selected from one of the following:

* hi
* hello
* read it immediately
* something for you
* warning
* information
* stolen
* fake
* unknown

The email body is selected from one the following:

* anything ok?
* what does it mean?
* ok
* i'm waiting
* read the details.
* here is the document.
* read it immediately!
* my hero
* here
* is that true?
* is that your name?
* is that your account?
* i wait for a reply!
* is that from you?
* you are a bad writer
* I have your password!
* something about you!
* kill the writer of this document!
* i hope it is not true!
* your name is wrong
* i found this document about you
* yes, really?
* that is bad
* here it is
* see you
* greetings
* stuff about you?
* something is going wrong!
* information about you
* about me
* from the chatter
* here, the serials
* here, the introduction
* here, the cheats
* that's funny
* do you?
* reply
* take it easy
* why?
* thats wrong
* misc
* you earn money
* you feel the same
* you try to steal
* you are bad
* something is going wrong
* something is fool

Manual Remove Instructions- for Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* \%WinDIR%\SERVICE.EXE

Start "regedit" after that and delete the following registry entries:

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run]
"service"="C:\\WINDOWS\\services.exe serv"

Restart your computer.

- for Windows 9x/Me:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear. Delete the following files:

* \%WinDIR%\SERVICE.EXE

Start "regedit" after that and delete the following registry entries:

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run]
"service"="C:\\WINDOWS\\services.exe serv"

Restart your computer.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .