The Netsky.R variant was discovered on March 31st, 2004. It's a stripped down version of NetSky.Q with around 80% of functionality in common with the previous variant.NetSky.R performs a DDoS against several websites.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Upon execution the worm copies its dropper to the Windows Directory as 'PandaAVEngine.exe', which is added to the registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] = "PandaAVEngine" = "%WinDir%\PandaAVEngine.exe"
where %WinDir% represents Windows directory name.
The main DLL is placed to the same place with the filename 'temp09094283.dll'.
The worm removes several registry values that belong to other worms.
When collecting addresses NetSky.R recursively searches through all hard drives and checks the content of files with the following extensions:
.adb .asp .cfg .cgi .dbx .dhtm .doc .eml .htm .html .jsp .mbx .mdx .mht .mmf .msg .nch .ods .oft .php .pl .ppt .rtf .sht .shtm .stm .tbb .txt .uin .vbs .wab .wsh .xls .xml
This variant of NetSky sends emails having the following subject:
Re: Document [random numbers]
Body:
Excuse me, the important document is attached, Yours sincerely
And attachment name:
Document[random numbers].pif
Between 11th and 17th of April, 2004 NetSky.R infected computers will perform a Distributed Denial-of-Service attack against the following sites:
www.keygen.us www.kazaa.com www.emule-project.net www.cracks.am www.emule.de