Threat Description



Category: Malware
Type: Email-Worm
Platform: W32
Aliases: NetSky.R, W32/Netsky.R, I-Worm.Netsky.s, W32/Netsky.R@mm


The Netsky.R variant was discovered on March 31st, 2004. It's a stripped down version of NetSky.Q with around 80% of functionality in common with the previous variant.NetSky.R performs a DDoS against several websites.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

System Infection

Upon execution the worm copies its dropper to the Windows Directory as 'PandaAVEngine.exe', which is added to the registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] =    "PandaAVEngine" = "%WinDir%\PandaAVEngine.exe"  

where %WinDir% represents Windows directory name.

The main DLL is placed to the same place with the filename 'temp09094283.dll'.

The worm removes several registry values that belong to other worms.

Email Propagation

When collecting addresses NetSky.R recursively searches through all hard drives and checks the content of files with the following extensions:

.adb  .asp  .cfg  .cgi  .dbx  .dhtm  .doc  .eml  .htm  .html  .jsp  .mbx  .mdx  .mht  .mmf  .msg  .nch  .ods  .oft  .php  .pl  .ppt  .rtf  .sht  .shtm  .stm  .tbb  .txt  .uin  .vbs  .wab  .wsh  .xls  .xml  

This variant of NetSky sends emails having the following subject:

Re: Document [random numbers]


Excuse me,  the important document is attached,  Yours sincerely  

And attachment name:

Document[random numbers].pif  

Between 11th and 17th of April, 2004 NetSky.R infected computers will perform a Distributed Denial-of-Service attack against the following sites:  


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More