I-Worm/NetSky.m
I-Worm/NetSky.m
I-Worm/NetSky.m“网络天空”最新变种,该病毒在感染计算机上的硬盘和网络映射驱动器上搜索电子邮件地址，并利用其自带的SMTP引擎通过发送电子邮件传播。带毒电子邮件的主题、内容和附件名称随机变化，所有附件文件都以.pif为扩展名。
其特征如下：
·拷贝自身到%Windir%AVProtect.exe。
·在注册表启动项HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrent VersionRun下创建：“9xHtProtect” = “%Windir%AVProtect9x.exe” 这样病毒在Windows启动时就得以运行。
·遍历盘符从C到Z的所有硬盘及映射驱动器，在下列种类的文件中搜索合法电子邮件地址：
.adb .asp .cgi .dbx .dhtm .doc .eml .htm
.html .jsp .msg .oft .php .pl .rtf .sht .shtm
.tbb .txt .uin .vbs .wab .wsh .xml
·利用其自身的SMTP引擎向搜索到的电子邮件地址发送带毒邮件。信件特征如下：
发信人：<伪造>
主题为下列之一：
Re: <%s> Requested file
Re: <%s> My file
Re: <%s> My document
Re: <%s> My information
Re: <%s> My details
Re: <%s> Information
Re: <%s> Improved
Re: <%s> Requested document
Re: <%s> Document
Re: <%s> Details
Re: <%s> Your document
Re: <%s> Your details
Re: <%s> Approved
信件内容为下列之一：
Details for %s.
Document %s.
I have received your document. The improved document %s is attached.
I have attached your document %s.
Your document %s is attached to this mail.
Authentification for %s required.
Requested file %s.
See the file %s.
Please read the important message msg_%s.
Please confirm the document %s.
%s is attached.
Your file %s is attached.
Please read the document %s.
Your document %s is attached.
Please read the attached file %s.
Please see the attached file %s for details
附件即为病毒程序，以.pif为扩展名，可能为：
improved_%s.pif
message_%s.pif
detailed_%s.pif
your_document_%s.pif
word_doc_%s.pif
doc_%s.pif
articel_%s.pif
picture_%s.pif
file_%s.pif
your_file_%s.pif
details_%s.pif
document_%s.pif
%s.pif
具有欺骗性的是，上面的%s是收信人本身的邮件地址名，即邮件地址’@’前面的字串。