Upon execution of the infected attachment, the worm copies itself as Jammer2nd.exe in the Windows folder. The worm also creates a file PK_ZIP_ALG.LOG and PK_ZIP<random number>.LOG in the Windows folder.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system;

.pl, .rtf, .oft, .txt, .uin, .jsp, .tbb, .cgi, .sht, .vbs, .doc, .dbx, .asp, .adb, .php, .htm, .eml, .xml, .wab, .wsh, .msg, .html, .dhtm, .shtm

The worm mails itself to these addresses using its own SMTP engine.

The worm opens port 665 to allow access to the infected system. It also attempts to perform a DOS attack on the following sites, if the system date is between May 2 and May 5;

www.medinfo.ufl.edu
www.nibis.de
www.educa.ch

This worm first appeared on April 21, 2004.

 Other names of W32/Netsky.Z Worm:

This worm is also known as WORM_NETSKY.Z, W32/Netsky.Z@MM, Netsky.Z, W32/Netsky-Z.