Aliases
W32/Lovsan.worm, W32.Blaster.Worm, WORM_MSBLAST.A, Win32.Poza, Worm/Lovsan.A
Type
Win32 worm
Description
W32/Netsky-N is a mass-mailing worm which spreads by emailing itself to addresses harvested from files on the local drives. The worm copies itself to the Windows folder as VisualGuard.exe and adds the following registry entry to run itself whenever the user logs on to the computer: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ NetDy= <Windows>\VisualGuard.exe W32/Netsky-N harvests email addresses from files with the following extensions: PL, HTM, HTML, EML, TXT, PHP, ASP, VBS, RTF, UIN, SHTM, CGI, DHTM, ADB, TBB, DBX, SHT, OFT, MSG, JSP, WSH, XML.

Emails have the following characteristics:
Subject lines: constructed from the following groups of strings
Re:
Re:re:

my
approved
important

document
file
details
information
letter
product
website
application
screensaver
bill
word document
excel document
data
message
text
document_all

hi
hello
thanks!
approved
corrected
patched
improved
important
read it immediately

Message texts: chosen from -

Please see the attached file for details.
Please read the attached file.
Your document is attached.
Please read the document.
Your file is attached.
Your document is attached.
Please confirm the document.
Please read the important document.
See the file.
Requested file.
Authentication required.
Your document is attached to this mail....
I have attached your document.
I have received your document. The corrected document is attached.

followed by

<attached filename>: No virus found
>n OnlineScan

followed by the logo of an anti-virus company.

Attached file:

<filename>_ <recipient_name>.<extension>

<filename> chosen from -

document
file
details
information
letter
product
website
application
screensaver
bill
word document
excel document
data
message
text
document_all

<extension> chosen from:

EXE
SCR
PIF
ZIP

W32/Netsky-N attempts to delete registry entries which may be created by variants of the W32/MyDoom and W32/Bagle worms.

W32/Netsky-N also creates a number of TMP files in the Windows folder:
base64.tmp, zip1.tmp, zip2.tmp, zip3.tmp, zip4.tmp, zip5.tmp, zip6.tmp, zipped.tmp.

¡@