• Our company (TicketWorld) is the world's largest supplier of tickets to all major international events including the 2006 Winter Games and 2006 Torino Tickets. We sell tickets to every sporting event in Torino including the preliminary competitions as well as Olympic Finals tickets. You can order Winter Games tickets for all categories for every match. All Winter Games tickets are guaranteed 200%.
  
  All ticket prices are in US Currency ($).
  
  OPEN ATTACHMENT ARCHIVE TO GET INFORMATION HOW TO OBTAIN A FREE TOCKET.
  
  Please call our United States office at +1.512.472.5797 or from the United Kingdom 0800.781.0819 if you have questions.
• The Torino Winter games will be the most celebrated Olympics of our era. If you are looking to witness this historic event for yourself, look no further. SuperTicketing Premium Seating is your source for Olympics tickets. We have access to tickets for nearly every Olympic event from Opening to Closing Ceremonies, Curling to Figure Skating.
  
  FREE TICKECKS AVAILABLE NOW ON LOTTERY BASIS. CHECK ATTACHED FILE.
  
  DISCLAIMER
  TickCo Premium Seating buys and resells tickets on the secondary market at above face value. Our prices can be substantially higher than the original ticket price, as they reflect the cost of obtaining premium seating. Any trademarked terms that appear on this page are used for descriptive purposes only.
• Attention: you recieved free ticket invitation with attachment!
  
  Coast to Coast Tickets provides the most comprehensive inventory of Opening Ceremony tickets available on the secondary market. If the Opening Ceremony tickets you are looking for are not available, please check back as our inventory is constantly updated. Orders for Opening Ceremony tickets that are no longer available will be cancelled or substituted at the customer's discretion. All Opening Ceremony tickets are shipped via Federal Express.
  
  If you would like to attend a Opening Ceremony event to see athletes live, or to see a team schedule and information, Coast to Coast Tickets is your source. All it takes is a phone call or a few clicks of the mouse to buy Opening Ceremony tickets. We offer a wide selection of Winter Games tickets for all teams, and we are happy to provide information about schedules at any time. 

Anexado, uno de los siguientes:

• Generated_bill.exe
• Order_details.exe
• Service_receipt.exe

Al ser ejecutado el gusano muestra esta caja de diálogo:

Luego se copia a las siguientes rutas y con los nombres:

• %Windows%\Wimanager.exe (componente del gusano)
• %System%\lsamgr.exe (copia del gusano)
• %System%\lsamgr.exeopen (copia del gusano con código basura)
• %System%\lsamgr.exeopenopen (copia del gusano con código basura)

para ejecutarse la próxima vez que se re-inicie el sistema crea la siguiente llave de registro:

[HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run] 
"LsaManager" = "%System%\lsamgr.exe"

para eludir el Firewall de MS Windows se agrega a la lista de excepción del Firewall creando la llave:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\ 
AuthorizedApplications\List 
"[ruta_y_nombre_de_archivo_infectado]" = "[ruta_y_nombre_de_archivo_infectado]:*:ipsec"

crea además los siguientes Mutex para evitar la ejecución de variantes del gusano Netsky, si es que las hubieren en el sistema infectado:

• [SkyNet.cz]SystemsMutex
• ____--->>>>U<<<<--____
• _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_
• _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
• AdmSkynetJklS003
• 'D'r'o'p'p'e'd'S'k'y'N'e't'
• MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D

Al siguiente inicio del equipo se activa en memoria y borra los siguientes valores de software antivirus o programas de seguridad:

• 9XHtProtect
• Antivirus
• EasyAV
• FirewallSvr
• HtProtect
• ICQ Net
• ICQNet
• Jammer2nd
• KasperskyAVEng
• MsInfo
• My AV
• NetDy
• Norton Antivirus AV
• PandaAVEngine
• service
• SkynetsRevenge
• Special Firewall Service
• SysMonXP
• Tiny AV
• Zone Labs Client Ex

de las siguientes llaves: 

• [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

Para propagarse a través de las redes Peer to Peer se copia a las carpetas de descarga que tengan la cadena de texto shar, en caso de estar instaladas, con los siguientes nombres:

• Adobe Photoshop 9 full.exe
• Ahead Nero 10.exe
• anna benson sex video.exe
• barrett jackson nude photos, movies, porn video.exe
• Britney Spears sex photos.exe
• IE beta 7.exe
• jenna elfman sex anal deepthroat
• kate beckinsale nude pictures.exe
• miss america Porno, sex, oral, anal cool, awesome!!.exe
• paris hilton Porno pics arhive, xxx.exe
• Porno Screensaver.scr
• Serials 2005 database.exe
• Serials.txt.exe
• Windown Vista Beta Leak.exe
• Windows Sourcecode update.doc.exe
• XXX hardcore images.exe

Luego el gusano intenta infructuosamente descargar de diversos sitios web el archivo get.php (actualmente deshabilitado).

En su código se puede leer este texto: