Netsky.P@mm - F-Prot Antivirus Virus Information

Virus Info > Virus Threats > Netsky.P@mm

Summary of W32/Netsky.P@mm
Alias:	I-Worm.Moodown.p, Win32.Netsky.P, W32/Netsky.p@MM
Discovered:	21 Mar 2004
Definition files:	21 Mar 2004
Risk Level:	High
Distribution:	High

Jump to:

Brief description
Technical description

Brief Description

Netsky.P@mm is UPX packed and spreads by sending itself as a attachment using email, the attachment is a FSG packed file that drops the UPX packed Netsky.P@mm. It also tries to propagate through p2p services such as kazaa and morpheus to get more distribution. To avoid being detected and/or removed, it disables certain services and programs by impeding them from starting up at reboot.

Technical Description

The worm consists of two parts, the dropper and the email worm itself. The droppers part in this is to conceal the actual virus, or at least try to. It attempts to do that by keeping the worm code crypted in the resource section, when executed the dropper loads the crypted worm code file, decrypts it and puts it in the windows directory, the worm is dropped as a DLL, to ensure it goes to the right directory on every windows platform it uses the return value from the API function GetWindowsDirectoryA. It is vital for the worm file to be in the windows directory because the dropper uses the LoadLibraryA function to put the worm code in memory and then calls a certain function from the code to execute the worm.

After the worm code has been initiated it does the following things.

It creates value called "Norton Antivirus AV" in the following registry key and it points to the worm file that the dropper dropped in the windows directory under the name FVProtect.exe.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

It creates a Mutex, undier the name "_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_" ,to know if it is already running. If so it terminates the current process.

Creates several files in the windows directory, both ready templates and copies of the worm.

Double extensions are used for some of those files, the purpose is to fool the user to click on it thinking that it is not an executable.

Then it creates a thread that skims drives from drive C: to Z:, skipping CD-Roms drive. It uses crude method to locate certain directories names, if it encounters any of those below it will copy itself into those directories

It uses one of those names for the copied files. It still uses double extensions for many of the files to increase the likelihood of getting executed by unsuspecting user.

While skimming the drive it also searches for files with the following extensions and harvests email addresses from those files to use for mass-mailing.

The mailing routine does not send messages to addresses that include the some of the words below, the reason for this was probably delaying detection of the worm.

@microsof, @antivi, @symantec, @spam, @avp, @f-secur, @bitdefender, @norman, @mcafee, @kaspersky, @f-pro, @norton, @fbi, buse@, @messagel, @skynet, @pandasof, @freeav, @sophos, @antivir, @viruslis, noreply@, spam@, reports@

Here is the list for possible e-mail subjects.

Note that the subjects below can contain "Re: " or "Re: Re: " infront of them.

The words "my", "approved" and "important" are randomly put in front of the following strings for the subject line, those strings can also be used in the body of the e-mail.

The body can contain one of the following sentences.

And the following fake e-mail scanning reports are sometimes attached at the end of the virus body.

The attachment can be one of the following.

The attachments can have dual extensions separated by numerous spaces and might look something like the example below. The first extension can be either ".doc" or ".txt". And the second extension can be one of the following ".zip",".scr",".exe",".pif".

Ragnar Gisli - Senior Virus Researcher

Virus Info by Platform