Discussion in 'malware problems & news' started by Marianna, Apr 20, 2004.

Thread Status:
Not open for further replies.
  1. Marianna

    Marianna Spyware Fighter

    Apr 23, 2002
    B.C. Canada
    I-Worm.NetSky.w, W32/Netsky.v@MM, W32.Netsky.V@mm, HTML/Debeski

    Win32 worm

    W32/Netsky-V is a worm which uses a combination of email, HTTP and FTP to spread. The worm itself is a Windows program (EXE) file.
    W32/Netsky-V searches your hard disk for email addresses and sends email directly to them. Note that these emails do not contain an attached copy of W32/Netsky-V. Instead, they contain HTML instructions to fetch a copy of the worm. The emails use a subject and message randomly selected from the following:

    Subject line:
    Mail Delivery Sytem failure
    Mail delivery failed
    Server Status failure
    Gateway Status failure

    Visible message text:
    The processing of this message can take a few minutes...
    Converting message. Please wait...
    Please wait while loading failed message...
    Please wait while converting the message...

    W32/Netsky-V opens up two TCP ports on your computer. An HTTP service listens on port 5557 and an FTP service listens on port 5556. These ports are used to "serve up" the virus to downstream victims to whom you have sent copies of the email mentioned above.

    Downstream victims can become infected simply by reading an email sent by the virus. Note, however, that this email relies on a bug in Microsoft Outlook for which a patch has already been published. If you have downloaded and applied up-to-date patches from Microsoft, then the exploit used by this email will not work and the email is harmless.

    If your computer has an unpatched copy of Outlook, the W32/Netsky-V email makes an HTTP (web) connection back to port 5557 on the computer which sent you the email. This web connection is used to download a second HTML script. This script in turn exploits a second bug in Outlook to make an FTP connection back to port 5556. The FTP connection is used to download, install and run the W32/Netsky-V worm.

    W32/Netsky-V is installed into your Windows folder with the name KasperskyAVEng.exe. The worm adds the registry value:


    to the registry key:


    so that it runs automatically every time you logon to your computer.

    Between 22 April 2004 and 28 April 2004, W32/Netsky-V mounts a denial of service attack against the following sites:


    The denial of service consists of four redundant HTML requests to each of these sites every second.

Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.