Threat description




A new variant of Netsky worm - Netsky.J was found on March 8th, 2004.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:

Technical Details

Descriptions of all previous NetSky worm variants can be found here:

The worm's file is a PE executable file 27648 bytes long.

NetSky.J worm has a few modifications comparing to previous variants:

  • The worm uses a different mutex: "SkYnEt_AVP"
  • The worm has message for Bagle And Mydoom worm authors in the same lines as previous ones.
  • The worm uses the following subject texts:
    • Your product
    • Your letter
    • Re: corrected homework
    • Re: I've found your document
    • Re: Your bill
    • Re: hello again
    • Re: hi again
    • Re: part 3
    • Re: important document part 2
    • Re: important
    • Re: Your data
    • Re: Your application
    • Re: your music
    • Re: excel document
    • Re: Re: Re: word document
    • Re: Your details
    • Re: My details
    • Re: Your requested file
    • Re: Read it immediately
    • Re: Approved
    • Re: Your software
    • Re: my memberlist
    • Re: Your document
    • Re: Your file
    • Re: Your important document
    • Hi Mr. %s
    • Moi %s
    • He %s
    • Yours faithfully, %s
    • Message to %s
    • Hi Mrs. %s
    • Is %s.doc yours?
    • Is %s.xls yours?
    • Whats up %s
    • Na %s
    • Best %s
    • Love %s
    • Good morning %s
    • Have a good day %s
    • Dear %s
    • To %s , it's me
    • Welcome %s
    • Moin %s
    • Hello %s
    • Your account %s is expired!
    • Hey %s
    • Hi %s
    •, your website
    • Hi %s, your product
    • Hello %s, your letter
    • Re: Hi %s, your archive
    • Re: %s, your text
    • Re: Hello %s, your bill
    • Re: Hi %s, your details
    • Re: Hello %s, my details
    • Re: Hi %s, your word file
    • Re: Hello %s, your excel file
    • Re: Hi %s, details
    • Re: Hello %s, Approved
    • Re: Hello %s, your software
    • Re: Hi %s, your music
    • Re: Dear %s, Here
    • Re: Re: Re: Hello %s, your document
    • Re: Hi %s
    • Re: Dear %s, Hi
    • Re: Re: Hi %s, your message
    • Re: Here %s, your picture
    • Re: Hi %s, here is the document
    • Re: Hello %s, your document
    • Re: %s, thanks!
    • Re: Re: %s, thanks!
    • Re: Re: Hi %s, document
    • Re: Hello %s, document
    Where %s will be substituted by some text.
  • The worm uses the following message body texts:
    • My details are in the attached file.
    • I have corrected your document.
    • Please do not forget to read the important document.
    • I have an interesting document about you.
    • The sample is attached.
    • Your personal document is attached.
    • Your file is attached to this mail.
    • Note that I have attached your file.
    • The important document is attached.
    • Please read the document. It's important.
    • Your document is attached to this mail.
    • See the attachment for further details.
    • Your file is attached. Use this password for the file: %i.
    • Please read the attached file. Password for the file is %i.
    • Please have a look at the attached file. Password for decrypting is %i.
    • See the attached file for details. Password is %i.
    • Here is the file. My password is %i.
    • Your document is attached. Your password is %i.
  • The worm installs itself to system as avpguard.exe file.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info