Updates its code by downloading a configuration file from the following URL: NOTE: The worm uses a hardcoded path during its replication so that it will work only Brazilian/Spanish Windows machines.ħ. \\C$\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar The worm tries to copy its executable in the following remote folder: Attempts to spread across local network shares by copying itself on the startup folder of remote machines found. * C:\Windows\maq.txt - list of hosts in network sharesĦ. * C:\Windows\view.txt - output of system.bat Creates and executes the following batch file to enumerate all the hosts in network shares of the infected machine: So that it runs every time Windows starts.Ĥ. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ Checks for the presence of the following file and stops the execution if that file exists: When is executed, it performs the following actions:Ģ. Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP The worm may download and execute remote files and send gathered information to a remote host. It steals confidential information and accounts when users contact a bank Web site. is a network worm that spreads on shared drive and folders. To remove some viruses it is advisable to turn off System Restore. Netsky is still infecting computers after being first discovered in April 2004. We stock the most efficient anti virus program which checks for updates hourly.Ĭontact Us for a free antivirus trial to the end of this month.Īdd "Virus Trial" to the Comments area. By the time you receive the e-mail 'virus alert' it can be too late!
0 kommentar(er)
