quote:

---

Upon execution, this NETSKY variant drops the following files in the Windows folder:

•CCOMP.CPL – a copy of itself
•WSERVER.EXE – its memory-resident component

It creates the following registry entry so that it executes at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Wserver = "%Windows%\wserver.exe"

(Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WINNT.)

---