Infos-Malware d'a-squared

Nom: Worm.Win32.NetSky.D

Description :

Symptoms:
Presence of the following file in Windows directory (%WINDIR%)
"winlogon.exe"

Presence of the following entry in "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" registry key:
"ICQ Net" = "winlogon.exe -stealth"

Technical description:
This variant of the NetSky worm (.D) spreads only via e-mail (in contrast
with previous versions, which spread through some P2P applications as well),
sending itself to e-mail addresses found in the infected computer.

The worm arrives in the following e-mail format:

Subject - randomly chosen from the following strings:
"Re: Re: Document"
"Re: Re: Thanks!"
"Re: Thanks!"
"Re: Your document"
"Re: Here is the document"
"Re: Your picture"
"Re: Re: Message"
"Re: Hi"
"Re: Hello"
"Re: Re: Re: Your document"
"Re: Here"
"Re: Your music"
"Re: Your software"
"Re: Approved"
"Re: Details"
"Re: Excel file"
"Re: Word file"
"Re: My details"
"Re: Your details"
"Re: Your bill"
"Re: Your text"
"Re: Your archive"
"Re: Your letter"
"Re: Your product"
"Re: Your website"

Body - randomly chosen from the following strings:
"Your document is attached."
"Here is the file."
"See the attached file for details."
"Please have a look at the attached file."
"Please read the attached file."
"Your file is attached."

Attached filename (and extension) - randomly chosen from the following strings:
"your_document.pif"
"your_document.pif"
"document.pif"
"message_part2.pif"
"your_document.pif"
"document_full.pif"
"your_picture.pif"
"message_details.pif"
"your_file.pif"
"your_picture.pif"
"document_4351.pif"
"yours.pif"
"mp3music.pif"
"application.pif"
"all_document.pif"
"my_details.pif"
"document_excel.pif"
"document_word.pif"
"my_details.pif"
"your_details.pif"
"your_bill.pif"
"your_text.pif"
"your_archive.pif"
"your_letter.pif"
"your_product.pif"
"your_website.pif"

When the user double-clicks the e-mail attachment, the worm does the following:

- copies itself to Windows directory (%WINDIR%) as "winlogon.exe";

- adds the following entry to "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
registry key:
"ICQ net" = "winlogon.exe -stealth",
(so it will be executed each time Windows starts up);

- disables some antivirus software and other known worms (such as Mydoom.A
and Mydoom.B) by deleting relevant registry keys;

- scans the infected computers for e-mail addresses in files whose extension
is one of the following:
".eml"
".txt"
".php"
".pl"
".htm"
".html"
".vbs"
".rtf"
".uin"
".asp"
".wab"
".doc"
".adb"
".tbb"
".dbx"
".sht"
".oft"
".msg"
".shtm"
".cgi"
".dhtm"

- creates and sends e-mails to these addresses with the above described format:

- On 01 mar. 2004, between 6:00 and 9:00 am (local time, not GMT) the worm
generates in the computer's speaker sounds with random tones and durations.


This variant (.D) uses an improved routine for sending itself through
e-mail, allowing it to be sent several times faster than previous
variants (.A - .C).

The worm avoids sending itself to addresses containing at least one of
the following strings:
"icrosoft"
"antivi"
"ymantec"
"spam"
"avp"
"f-secur"
"itdefender"
"orman"
"cafee"
"aspersky"
"f-pro"
"orton"
"fbi"
"abuse"
"messagelabs"
"skynet"

Source: BitDefender Virus-Info

Instructions pour la suppression de Worm NetSky D:

Pour supprimer l'infection par ce Malware, téléchargez et installez s'il vous plaît a-squared Anti-Malware. Effectuez une analyse complète de tous les lecteurs et placez tous les objets détectés dans la quarantaine.

Plus de détails sur ce danger :

Des compléments d'information peuvent être trouvés ici :

Rechercher avec Google pour Worm NetSky D
Rechercher avec Bing pour Worm NetSky D
Rechercher avec Yahoo pour Worm NetSky D

Comment puis-je me protéger contre Worm NetSky D?

Important !
Vous avez essentiellement besoin d'un produit antivirus, qui non seulement est capable de supprimer les infections, mais également, de protéger votre ordinateur en permanence des nouveaux dangers. C'est le seul moyen d'empêcher la perte de données et des tracas inutiles et les conséquences de nouvelles installations de votre système d'exploitation.

N'hésitez pas, saisissez votre chance dès aujourd'hui, et achetez le logiciel de protection,a-squared Anti-Malware à qui de multiples prix ont été décernés !

Seulement 30€ pour la sécuriter de votre ordinateur.

Acheter a-squared Anti-Malware en ligne :

Faites seulement confiance au meilleur logiciel de protection !

Le meilleur dans les tests !

Plus d'études indépendantes sur les logiciels anti-malware (anglais)