Sonicwall Signatures


Go to All Categories list.

Netsky.P#fsg is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. Netsky.P#fsg has a file size of 29,568 bytes. Netsky.P#fsg drops the following files on the hard drive:
  • C:\WINDOWS\userconfig9x.dll (26624 bytes)
  • C:\WINDOWS\FVProtect.exe (29568 bytes)
  • C:\WINDOWS\base64.tmp (40520 bytes)
  • C:\WINDOWS\zipped.tmp (29832 bytes)
It also changes Windows registry:
  • Creates value "Norton Antivirus AV"="C:\WINDOWS\FVProtect.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: DroppedSkyNet. _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_. It also is executed every time Windows starts.

Relevant Information