W32/Netsky-G

Aliases
I-Worm.NetSky.g, W32/Netsky.c@MM

Type
Win32 worm

Description
W32/Netsky-G is a worm that spreads via email.
In order to run automatically when Windows starts up the worm copies itself to the file avguard.exe in the Windows folder and creates the following registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Special Firewall Service
= "C:\WINDOWS\avguard.exe -av service"

A detailed analysis of W32/Netsky-G will be published here shortly. Please check again later.

http://www.sophos.com/virusinfo/analyses/w32netskyg.html