NetSky.H worm doesn't copy its files to shared folders. Installation to system When run, the worm installs itself to system. It copies its file to Windows folder as MAJA.EXE and creates a startup key for this file in System Registry: [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Antivirus" = "%windir%\maja.exe -antivirus service" where %windir% represents Windows directory. The worm creates a mutex named "MI[SkyNet.cz]SystemsMutex" to avoid running more than one instance of itself. Spreading in e-mails NetSky.H worm has its own SMTP engine that it uses to send emails with infected attachments to all found e-mail addresses. The worm uses different subjects, message body texts and attachment names in its e-mails.