Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLM.Netsky.18971

Added to the Dr.Web virus database: 2011-09-13

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\6to4] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
  • C:\Del1.tmp -delself 208 "<SYSTEM32>\web.exe"
  • <SYSTEM32>\web.exe 
  • <SYSTEM32>\ActiveX.exe 
Modifies file system :
Creates the following files:
  • C:\Del1.tmp
  • %WINDIR%\Temp\~tmp75f53094.old
  • <SYSTEM32>\pop3server.dll
  • <SYSTEM32>\ActiveX.exe
  • <SYSTEM32>\web.exe
Deletes the following files:
  • <SYSTEM32>\web.exe
Network activity:
Connects to:
  • 'ou#####2003.xicp.net':80
UDP:
  • DNS ASK www.si##.com
  • DNS ASK ou#####2003.xicp.net
  • DNS ASK www.google.com
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: ''