IT-Review

Netsky.AG@MM Became More Dangerous

McAfee AVERT raised the risk assessment to Medium on the recently discovered W32/Netsky.ag@MM, also known as Netsky.ag.

Netsky.ag is a mass mailing threat that contains its own SMTP engine to construct outgoing messages. It harvests addresses from local files and then uses the harvested addresses in the ‘From’ field to send itself. This produces a message with a spoofed From address. When run, the worm displays a message box, “File corrupted replace this!” Users should be very wary and should most likely delete any email containing the following:

Netsky.ag copies itself to local folders containing string share or sharing, network shares and P2P shared folders. After being executed, the worm copies itself into the Windows System directory (%WinDir%\MsnMsgrs.exe). The following Registry key is added to hook system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\CurrentVersion\Run "MsnMsgr" = %WinDir%\MsnMsgrs.exe -alev The worm then emails itself to addresses found on the infected host as a .PIF, .COM, .SCR, .BAT, or .ZIP file.

See also: