Nome: I-WORM.Netsky.B

Alias: 

Tipologia: Internet Worm

Dimensione: 22016 byte 

Piattaforma: Win 95/98/ME/NT/2000/XP 

Descrizione:

Questo worm arriva attraverso la posta elettronica allegando un file infetto.
Il messaggio infetto ha i seguenti oggetti:

unknown
fake
stolen
information
warning
something
for you
read it immediately
hello
hi

Con i seguenti corpi di messaggio:

something is fool
something is going wrong
you are bad you try to steal
you feel the same
you earn money
thats wrong why?
take it easy
reply
do you? that's funny
here, the cheats
here, the introduction
here, the serials
from the chatter 
about me
information about you 
something is going wrong!
stuff about you?
greetings 
see you here it is
that is bad yes, really? 
i found this document about you your name is wrong
i hope it is not true!
kill the writer of this document!
something about you!
I have your password! 
you are a bad writer
is that from you? 
i wait for a reply! is that your account? 
is that your name? 
is that true? 
here 
my hero read it immediately!
here is the document. 
read the details. 
i'm waiting ok 
what does it mean? 
anything ok? 

Il worm puņ allegare uno dei seguenti file infetti:

misc
party
disco
part2
mail2
object
ranking
dinner
release
final
location
jokes
friend
website
mails
story
found
nomoney
aboutyou 
shower
ps
topseller
product
swimmingpool
bill
note
concert
textfile
posting
stuff
me
attachment
details
creditcard
message
talk
doc
msg
document 

con le seguenti tipologie di estensioni di file: .pif .com .scr .exe 


Se eseguito il worm crea il seguente file SERVICES.EXE nella cartella di WINDOWS e
modifica il file di registro per metterlo in esecuzione automatica, alla fine visualizza
il seguente messaggio di errore:

The file could not be opened! 

Dopo che il worm č attivo crea i seguenti file infetti: 

doom2.doc.pif 
sex sex sex sex.doc.exe 
rfc compilation.doc.exe
dictionary.doc.exe 
win longhorn.doc.exe 
e.book.doc.exe
programming basics.doc.exe 
how to hack.doc.exe 
max payne 2.crack.exe 
e-book.archive.doc.exe 
virii.scr 
nero.7.exe 
eminem - lick my pussy.mp3.pif
cool screensaver.scr 
serial.txt.exe 
office_crack.exe 
hardcore porn.jpg.exe 
angels.pif 
porno.scr 
matrix.scr 
photoshop 9 crack.exe 
strippoker.exe 
dolly_buster.jpg.pif 
winxp_crack.exe

Il worm Netsky recupera gli indirizzi e-mail dai seguenti file: .msg .oft .sht
.dbx .tbb .adb .doc .wab .asp .uin .rtf
.vbs .html .htm .pl .php .txt .eml

18/02/2004 - Tutti i diritti riservati TG Soft S.a.s. - http://www.tgsoft.it

Analisi a cura: Ing. G. Tonello