I-Worm/NetSky.m

I-Worm/NetSky.m“网络天空”最新变种,该病毒在感染计算机上的硬盘和网络映射驱动器上搜索电子邮件地址，并利用其自带的SMTP引擎通过发送电子邮件传播。带毒电子邮件的主题、内容和附件名称随机变化，所有附件文件都以.pif为扩展名。

其特征如下：

·拷贝自身到%Windir%\\AVProtect.exe。

·在注册表启动项HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Current Version\\Run下创建：“9xHtProtect” = “%Windir%\\AVProtect9x.exe” 这样病毒在Windows启动时就得以运行。

·遍历盘符从C到Z的所有硬盘及映射驱动器，在下列种类的文件中搜索合法电子邮件地址：

.adb .asp .cgi .dbx .dhtm .doc .eml .htm

.html .jsp .msg .oft .php .pl .rtf .sht .shtm

.tbb .txt .uin .vbs .wab .wsh .xml

·利用其自身的SMTP引擎向搜索到的电子邮件地址发送带毒邮件。信件特征如下：

发信人：<伪造>

主题为下列之一：

Re: <%s> Requested file

Re: <%s> My file

Re: <%s> My document

Re: <%s> My information

Re: <%s> My details

Re: <%s> Information

Re: <%s> Improved

Re: <%s> Requested document

Re: <%s> Document

Re: <%s> Details

Re: <%s> Your document

Re: <%s> Your details

Re: <%s> Approved

信件内容为下列之一：

Details for %s.

Document %s.

I have received your document. The improved document %s is attached.

I have attached your document %s.

Your document %s is attached to this mail.

Authentification for %s required.

Requested file %s.

See the file %s.

Please read the important message msg_%s.

Please confirm the document %s.

%s is attached.

Your file %s is attached.

Please read the document %s.

Your document %s is attached.

Please read the attached file %s.

Please see the attached file %s for details

附件即为病毒程序，以.pif为扩展名，可能为：

improved_%s.pif

message_%s.pif

detailed_%s.pif

your_document_%s.pif

word_doc_%s.pif

doc_%s.pif

articel_%s.pif

picture_%s.pif

file_%s.pif

your_file_%s.pif

details_%s.pif

document_%s.pif

%s.pif

具有欺骗性的是，上面的%s是收信人本身的邮件地址名，即邮件地址’@’前面的字串。