WORM_NETSKY.C

This new NETSKY variant spreads via email using its own SMTP (Simple Mail Transfer Protocol) engine. It also drops several copies of itself in folders that have the string "shar" in their names and are located under the Windows directory. It drops copies with enticing file names and may successfully propagate via folders shared on various networks.

The email message it sends out has varying details. Below are screenshots of some of its email messages:

If the current system date is February 26, 2004 and the time is between 6 and 9 AM, this malware generates beeping sounds.

Additionally, this worm disables other malware. It deletes the registry entries used by certain malware to automatically execute at system startup.

This memory-resident malware runs on Windows 95, 98, ME, NT, 2000, and XP.

Related Items