MapleLeaf
Premium
join:2001-09-04
Burnaby, BC
| I-Worm.Netsky.ac {KAV}
I think it wasn't reported here, but if it was (I searched, honest  ) - I am sorry for the dupe.
I-Worm.Netsky.ac
»www.viruslist.com/eng/viruslist.···=1413428
This worm spreads via the Internet as an attachment to infected messages, and via shared network resources. The worm itself is a Windows PE EXE file, 17920 bytes in size, packed using PE-Patch. The unpacked file is approximately 1.5MB in size. It is written in Microsoft Visual C.
The worm is only activated if the user launches the infected file by clicking twice on the attachment. The worm then installs itself to the system and starts propagating.
Mass mailing
The worm uses a direct connection to the SMTP-server to send messages.
Installation
When installing, the wom copies itself to the Windows directory under the name csrss.exe and registers this file in the system registry auto-run key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\BagleAV
thus attempting to disguise itself as an antivirus working against Bagle.
Other
The worm attempts to delete registry keys created by I-Worm.Bagle.y
--
I have a soft spot for Russian made software |
