About NetSky.p

Also known as: WORM_Netsky.P, W32/Netsky.P@MM, W32/Netsky.P.worm, Win32.Netsky.P

Netsky.P is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives. The worm also tries to spread through various file-sharing programs by copying itself into various shared folders.

The From line of the email is spoofed, and its Subject line and message body of the email vary. The attachment name varies with the .exe, .pif, .scr, or .zip file extension.

Variants:

• NetSky.a
• NetSky.b
• NetSky.c
• NetSky.d
• NetSky.p
• NetSky.y
• NetSky.z

Removal Instructions

Automatic Removal:

Netsky.p can be detected and removed AUTOMATICALLY by McAfee VirusScan, also PestPatrol.

Manual Removal:

To remove this virus "by hand", follow these steps:

1. Terminate the FVPROTECT.EXE process using Windows Task Manager.
    
2. Delete the following files from your Windows directory (typically c:\windows or c:\winnt):
   1. FVPROTECT.EXE 
   2. USERCONFIG9X.DLL
   3. BASE64.TMP
   4. ZIP1.TMP
   5. ZIP2.TMP
   6. ZIP3.TMP
   7. ZIPPED.TMP
       
3. Delete the many copies of the worm dropped on the victim machine, with the enticing filenames as described above.
    
4. Edit the registry
   • Delete the "Norton Antivirus AV" value from
     • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
       Windows\CurrentVersion\Run
        
5. Reboot the system

Additional Windows ME/XP removal considerations

Removal Instructions for Other Worms