|W32.Netsky.I@mm is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives.
Copies itself as %Windir%\fooding.exe.
Deletes some values from the registry key (see avguard.exe - W32.Netsky.G@mm)
Scans the files on drives C through Z for email addresses.
Uses its own SMTP engine to send itself to the email addresses it found above, sending to each address once.
The email has the following characteristics:
Subject: (One of the following)
Mail account expired
Mail account closed
Mail account deactivated
Body: (One of the following)
Your mail account expired. Please follow the link to reactivate.
Your mail account has been closed. Click on the link for further details.
Your mail account has been deactivated. To reactivate, follow the link.
http:/ /www.[recipient domain]/[user]/index.scr
For example, a message to firstname.lastname@example.org would have the attachment name http:/ /www.hotmail.com/joe/index.scr.
and delete the value: "Tiny AV"="%Windir%\fooding.exe -antivirus service"
Or use antivirus (also check How To Remove section)Startup Optimizer to automatical remove it from the system registry.
Still have a problem? Ask for help at our discussion forum.