Netsky.C reaches computers in an e-mail message whose subject, message body and attached file are selected at random from a long list of options.
When the attached file is run, Netsky.C copies itself to all the disk drives on the computer under the name WINLOGON.EXE.
It spreads by sending itself out to all the e-mail address it finds in files with the extensions .eml, .txt, .php, .pl, .htm, .html, .vbs, .rtf, .uin, .asp, .wab, .doc, .adb, .tbb, .dbx, .sht, .oft, .msg, .shtm, .cgi, and .dhtm stored on the computer. It does this using its own SMTP engine.
The worm also copies itself under a wide range of names to all the folders on the computer whose name contains the sequence of letters 'shar'. By doing this, it can also spread through P2P file sharing applications like KaZaA.
Netsky.C has been designed to emit a specific sequence of sounds through the speakers of the affected computer between 06:00 a.m. and 08:59 a.m. on February 26.
Finally, this worm inserts several entries in the Windows Registry in order to ensure that it is run whenever the infected computer is started up. Similarly, it deletes any entries that may have been created by other malicious code such as Mydoom.A and Mimail.T
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.