Win32/Netsky.K
Created: 2007-06-26,
02:14:40
Last updated on: 2010-11-26,
09:27:25
| Platform: | Win32 | Type: | worm | Size: | 27648 | ||
| Date: | 2004-03-08 | ||||||
Language: Microsoft Visual C++
Endangered operating system(s): Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000 all...
Non-endangered operating system(s): Windows 3.xx, DOS, Linux, Unix, Solaris all...
Naming
The different antivirus applications use different names for the individual viruses and worms. Sometimes an antivirus application identifies the same individual malware using different names for different copies or different viruses and worms are identified with the same name. The informative list below contains the names for the malware given by the most popular antivirus applications. The names can vary using the different versions of the same antivirus application.| antivirus | naming |
| Avast |
Win32:Netsky-K |
| AVG |
I-Worm/Netsky.K |
| BitDefender |
Win32.Netsky.J@mm |
| e-Trust |
Win32/Netsky.K |
| F-PROT |
W32/Netsky.K@mm |
| F-Secure |
Email-Worm.Win32.NetSky.k |
| Ikarus |
Email-Worm.Win32.NetSky.K |
| Kaspersky |
Email-Worm.Win32.NetSky.k |
| McAfee |
W32/Netsky.k@MM(Virus) |
| Microsoft |
Win32/Netsky.J@mm |
| NOD32 (ESET) |
Win32/Netsky.K |
| Norton Antivirus |
W32.Netsky.J@mm |
| Panda |
W32/Netsky.K.worm |
| Rising Antivirus |
Worm.Netsky.k |
| Sophos |
W32/Netsky-K |
| Trend Micro |
WORM_NETSKY.K |
| VirusBuster |
I-Worm.Netsky.J |
| organization | naming |
| Wildlist | W32/Netsky.K-mm |
Installation
The main purpose of viruses and worms spreading on the Internet and local networks is to infect another computer. After this infection malware can modify the system and after a reboot process the malware code can be launched. For this purpose malware usually creates files in the operating system's area and modify the registry. According to this modification of the registry the operating system will execute the malware code as well. Besides, it is possible that they create files in other area (directory) of the file system. It is also possible that viruses and worms create AUTORUN.INF files in the root directories of the drives. In this case - according to the default settings of Windows - it automatically executes the malware once the user opens the root directory of the particular drive.The Win32/Netsky.K worm in the Windows folder (default: C:\Windows) creates the avpguard.exe files.
Win32/Netsky.K worm creates the [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "My AV"="C:\WINDOWS\avpguard.exe -av serv" entry in the registry or modifies it (if it exists already).
In order to limit the running of another malware, viruses and worms can interfere other malware as well when they erase registry entries according to each other.Win32/Netsky.K worm deletes the following entries from the registry:
Memory resident viruses and worms usually install themselves in the memory only once. For this purpose malware can use the operating feature and they can create mutexes. They can check the existence of this mutex before installing their code into the memory.
Win32/Netsky.K worm creates the SkYnEt_AVP mutex.
E-mail messages
The main aim of worms spreading in e-mail messages is to infect other computers. For this purpose they create and send e-mail messages to various e-mail addresses. The body of these messages usually include the code of the worm, but it is also possible that only a link is attached into the body and the user downloads the code of the worm. E-mail worms can create e-mail messages with various parameters.Win32/Netsky.K worm in order to spread creates ANSI format e-mail messages and forwards its own code.
For a better spreading e-mail worms and viruses use the attacked computer not only for forwarding its code but for searching potential e-mail addresses. These e-mail addresses are used as the addressee of the e-mail message and/or as the sender. Thus the sender address is modified by the malware.Win32/Netsky.K worm searches for e-mail addresses in the files with one of the following extensions:
The characteristics of the e-mail messages are the following:| Sender |
The sender addresses of the infected e-mails will be collected from the attacked computer(s). |
| Addressee |
The worm
sends the e-mail messages to the collected addresses.
The worm does not send infected email messages to the addresses containing one of the following strings: |
| Subject |
The potential subjects of the infected e-mail messages are the following: |
| Attachment |
The name of the attachment in the e-mail message sent by the worm is constructed from multiple parts. The first part of the name of the attachment in the e-mail message sent by the worm is constructed from the following strings: The second part of the name of the attachment in the e-mail message sent by the worm is constructed from the following strings: The file extension of the attachment of the e-mail message sent by the worm is pif . |
Backdoor
Viruses and worms more and more frequently open backdoors on the attacked computer. Thus the attacker can take full control over the machine. In this case the attacker can do whatever s/he wants on the computer: run or stop programs and applications, upload or download files, steal passwords and access codes.Win32/Netsky.K worm opens a backdoor on the port number 26 .
Payload functions
Every virus and worm can do what it or its programmer wants. Some malware executes its payload function depending on a particular event, sometimes these functions are executed on specific dates and time.Win32/Netsky.K worm executes the following payload functions:
| condition | from 10:00 a.m. until 11:00 a.m. on 10 March 2004 |
| activity |
repeats the following sound on the computer:
|
| condition | on 13 March 2004 |
| activity |
displays message windows
|
| condition | on 16 March 2004 |
| activity |
|
Others
The writers of the malware programs very often insert messages and pictures which are usually encrypted in some way. In many cases we find particular texts in the program code of viruses, program worms and other parasites, in which we encounter either the signature of the creator of the virus or the particular text parts used for the operation of the virus (file or directory names etc.). These texts are not always directly recognisable; in most cases they become visible and readable by decoding the coded virus program only.Text(s) in the program code of Win32/Netsky.K worm which are never displayed:
00 Skynet AntiVirus - We want to 00 destroy malware writers business, including MyDoom & 01 Bagle. To F-Secure and so on, we do not want damage systems, 02 we only want to avoid that Bagle continues his dirty03 business. We have respect of your work (Your heuristic scan is not good enough! Make it better).04 When the beagle and mydoom loose, we wanna stop our activity. thats now.05 And personal words to mydoom: Your are so shitty i never seen in my life.06 A Sample is bin laden and saddam. Your are more, more as more. worse than bad, the only worst.07 I cannot describe you, you're so lame. And to the mydoom thiefs: You will go08 into the prison next time in texas, nice to meet the bagle author there.09 Eat my shit, its similar your food, you know.10 And do not watch too much porn. Last words to all AV firms: We are the Skynet, not netsky!11 You can use commands on port 26 to deactivate the Skynet!.12 This is the last version of our antivirus. The source code is available soon.13 Note that the optimization limit is also reached. You can't get more with smtp engines.14 bagle and mydoom can continue his dirty impact. the 11th of march is the skynet day.