Active Scan. Scan your PC free
Premium Services
Premium Services

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.


Threat LevelLow threatDamageHighDistributionNot widespread


NetWorkControl carries out the following actions:

  • It reaches the computer in a file with the following icon:

    Icon of NetworkControl
  • Once run and after few seconds, it starts displaying warning messages like the following, informing users of an attack to the computer:

    Warning message displayed by NetworkControl
  • Other of the messages indicates that no software to block IP addresses has been found in the computer and shows a list of programs, inviting users to install a certain antivirus:

    Other of the messages displayed by NetworkControl
  • This antivirus, called ShieldEC, is just another fake antivirus program or rogueware.
  • If users decide to install this program, a window like the following will be displayed, requiring users an activation code:

    Activation message of the rogueware ShieldEC
  • From this moment on, the computer will be blocked, except from the window belonging to the program, which cannot be closed.
  • If users restart the computer, the following message will be displayed:

    Message displayed when restarting the computer

Infection strategy 

NetWorkControl creates a folder called NetworkControl in the root directory of the C: drive. In this folder, it creates the following files:

  • NC.EXE

Additionally, it creates the file I.BAT in the folder Local Settings of the Documents and Settings directory of the user that has logged in.


NetWorkControl creates the following entries in the Windows Registry:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    Shell = C:\NetworkControl\nc.exe -reboot

    By creating this entry, NetWorkControl ensures that it is run whenever Windows is started.
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    WarnonBadCertRecving = 00, 00, 00, 00
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    WarnOnPostRedirect = 00, 00, 00, 00
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    WarnOnZoneCrossing = 00, 00, 00, 00

    By creating these entries, NetWorkControl changes the Internet security settings, so that warning messages are not displayed.


NetWorkControl modifies the following Windows Registry entry, in order to change the Internet security settings and not show warning messages:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    WarnOnPost = 01, 00, 00, 00

    It changes this entry to:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    WarnOnPost = 00, 00, 00, 00

Means of transmission 

NetWorkControl can reach the computer when the user accesses certain websites which display banners or pop-up windows which lead to the download of this program. It can also reach the computer in a link that can be received via spam messages, fraudulent websites, etc.

Further Details  

NetWorkControl is 1,147,392 bytes in size.