Where %windir% represents Windows directory. 'ICQ Net' = '%windir%\winlogon.exe -stealth' The worm installs itself as WINLOGON.EXE file to Windowsįolder and creates a startup key for this file in the On February 26th, 2004 the worm constantly beeps with PC The worm doesn't show an error messagebox when run for the While the forth variant is packed with UPX file compressor. The third variant is packed with ASPack file compressor First two variants are packed with Petite fileĬompressor and one of those is 1 byte longer that another.
We received several differently packed variants of Moodown.C differences between Netsky.C variant and the previous.Descriptions of previous NetSky variants can be found here:
