NETSKY WORM

The NetSky Worm is a mass-mailer. It spreads by copying itself to all directories named "Share" or "Sharing", under the name doom2.doc.pif, e.book.doc.exe, winxp_crack.exe, dolly_buster.jpg.pif, strippoker.exe, photoshop 9 crack.exe, matrix.scr, hardcore pron.jpg.exe, angelis.pif, pornon.scr, office_crack.exe, serial.txt.exe, cool screensaver,scr, nero7.exe, virii.scr, eminem-lick my pussy.mp3.pif, max payne 2.crack.exe, programming.basics.doc.exe, how to hack.doc.exe, win longhorn.doc.exe, dictionary.doc.exe, rfc compilation.doc.exe, sex sex sex sex.doc.exe"

The attachment name will be selected by random and can be zip files or have double extensions.

The subject will be one of the following: hi, warning, unknown, fake, stolen, information, something for you, read it immediately, hello"


REMOVAL INSTRUCTIONS:

For Windows 95/98/ME:

• Run REGEDIT and delete the value:
  • service
    in registry key:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
• Boot up your computer from the A Drive using a Boot diskette
• Run Vbuster.Exe and use it to delete all occurances of the worm
  
  
  For Windows 2000/XP:
  
• Run REGEDIT and delete the value:
  • service
    in registry key:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
• Restart the computer
• When the computer is rebooting, tap on the F8 key
• Select "Boot up with Command Prompt"
• Select "Windows 2000 Operating System" or "Windows XP Operating System"
• Click on User-Box
• Put your Vbuster diskette in your Drive A
• At the A: prompt, type vbuster [ENTER]
• Use vbuster to delete all occurances of the worm
  
  
  For Window NT:
  
• Run REGEDIT and delete the value:
  • service="C:\\WINDOWS\\services.exe - serv"
    in registry key:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
• Click on "Start", "Run" and type "cmd"
• Press "Ctrl-Alt-Del"
• Click on "Processes"
• Select "Explorer.exe"
• Click on "End Process"
• Put your Vbuster diskette in your Drive A
• At the A: prompt, type vbuster [ENTER]
• Use vbuster to delete all occurances of the worm

Return Home