NetSky.C_2 is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. NetSky.C_2 has a file size of 28,160 bytes. NetSky.C_2 drops the following files on the hard drive: - C:\WINDOWS\winlogon.exe (28160 bytes)
It also changes Windows registry: - Creates value "ICQ Net"="C:\WINDOWS\winlogon.exe -stealth" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: [SkyNet.cz]SystemsMutex. It also is executed every time Windows starts.
|
