Threat description


Category: Malware
Type: Email-Worm
Platform: W32


NetSky.W worm variant was discovered on April 16th, 2004.Although it has been just discovered, this variant is much more similar to NetSky.P or NetSky.Q than to any of the later variants. In fact, its structure bears a striking resemblance to that of NetSky.P, so only some differences among them will be listed on this description.This variant does not spread through P2P networks, as NetSky.P does.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:

Technical Details

Installation to system

Upon execution Netsky.W copies itself as VisualGuard.exe file to the Windows folder. The worm adds a startup key for itself into System Registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]  "NetDy" = "%WinDir%\VisualGuard.exe"  

where %WinDir% represents Windows folder name.

Additionally the worm drops the following files into Windows folder:

zipped.tmp  base64.tmp  zip1.tmp  zip2.tmp  zip3.tmp  
Email Spreading

Most of the email spreading functionality is similar or identical to NetSky.P.

Deleting Registry keys and disinfecting Bagle worm

NetSky.W worm removes Registry keys of several Bagle worm variants if it finds them on an infected computer.


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More