[virusinfo] Sophos Anti-Virus IDE alert: W32/Netsky-X
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Tue, 20 Apr 2004 15:12:16 -0700
From; Sophos Alert System:
Name: W32/Netsky-X
Aliases: W32/Netsky.y@mm
Type: Win32 worm
Date: 20 April 2004
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the June 2004 (3.82) release of Sophos Anti-Virus.
Enterprise Manager and PureMessage customers will be
automatically protected at their next scheduled update.
Sophos has received several reports of this worm from the wild.
Information about W32/Netsky-X can be found at:
http://www.sophos.com/virusinfo/analyses/w32netskyx.html
Description
W32/Netsky-X is an email worm with backdoor functionality similar to
W32/Netsky-Y
The worm copies itself to the Windows folder using the name FirewallSvr.exe,
creates a file called fuck_you_bagle.txt (a base64 encoded form of the worm)
and sets the following registry entry to autostart on user login:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
FirewallSvr= C:\\FirewallSvr.exe
W32/Netsky-X has a backdoor component listening for connections on TCP port
82 allowing an unauthorised program to download and execute arbitrary code
on the infected computer.
The worm harvests email addresses from files on the local drives with the
following extensions:
adb, asp, cfg, cgi, dbx, dhtm, doc, eml, htm, html, jsp, mbx,
mdx, mht, mmf, msg, nch, oft, php, pl, ppt, rtf, shtm, tbb, txt,
uin, vbs, wab, wsh, xls, xml.
The analysis of this virus is in progress. Please come back for more
information later.
Recovery
Please follow the instructions for removing worms.
Download the IDE file from:
http://www.sophos.com/downloads/ide/netsky-x.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
---------------------------------------------------------------------
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] Sophos Anti-Virus IDE alert: W32/Netsky-X
