The Netsky Virus

[eoinh]

What does this exactly do?

And please no convoluted computer geeky speak - i only speak english :(

[dahamsta]

Depends on the time of day, the variant (there's lots of versions) and other factors, but it would do some or all of the following:


Change settings on your computer.
Create files on your computer.
Deletes files on your computer.
Make your PC speaker beep.
Search your computer for files containing email addresses.
Send email from your computer.
The latest version is Netsky.P (http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.p@mm.html). They go alphabetically all the way back to A.

adam

[eoinh]

I keep getting sent e-mails with the C variant (about 2 a day). The Norton anti-virus is blocking them. i recieved an email today and agin the norton blocks it and asks me to quarantine it (which i do). However after i do this the server is terminating the connection. so every time i go back into my mail im just getting the same e-mails again. ive done a scan and theres no virus present on my computer.


any ideas?

[dahamsta]

I know nothing about anti-virus tbh, haven't run one in half a decade. Try deleting it instead of quarantining?

adam

[Peadar]

Try deleting it instead of quarantining?

Yeah, delete the e-mail straight off.
Many AV programs only quarantine the attachment and leave the e-mail intact. Delete, delete, delete.

Make sure you have downloaded and installed all the latest security patches from Microsoft.

[eoinh]

can anybody suggest a good anti-virus email protector.

preferbly, one i can download.

[Peadar]

can anybody suggest a good anti-virus email protector.

If you're using Internet e-mail, i.e. eircom.net or Hotmail.com or something then the mail should be scanned by their mail servers.
Technically the mail isn't on your machine, you're simply viewing it from the Internet.
If you're just checking your mail with a mail client then you should ignore unexpected e-mail from people you don't know.
Delete it and empty your Deleted Items.
All e-mail should be scanned when it enters a network infrastructure before it reaches the e-mail server. It is the responsibility of the person hosting the mail server to manage this.

[eoinh]

ok thanks Peadar and dehamsta.

im with a tiny service provider (cablesurf) so i dont know if they do scan stuff. im getting a lot of obviously dodgy emails at the moment.

[dahamsta]

im with a tiny service provider (cablesurf)Jammy fecker. Half of Ireland would give their left nadger for a service like Caseys. :)

If in doubt, ask: Their email address is info@cablesurf.com.

adam

[A face]

Also .. a good method of prevention is to not open an dodgy looking mail at home and save this task for another public PC.

Always remember ... it is not a problem when it is someone else problem ;)

[eoinh]

Jammy fecker. Half of Ireland would give their left nadger for a service like Caseys. :)




Ah sure, who wants to be on the phone and the net at the same time with unlimited broadband access time for a fixed fee with a basic cable tv package of 50 channels thrown in as well. :D

[Peadar]

Also .. a good method of prevention is to not open an dodgy looking mail

Some mail providers advise you to download attachments and scan them on your PC. This is crazy as far as I'm concerned. If you don't recognise the address and or you weren't expecting the attachment, delete the mail item immediately. With a bit of common sense you'll be ok.

[Footie_Fan]

I got the Netsky D version sent to me to today. Norton picked up straight away and quarantined it and then I deleted it. Hail Norton!

[pete]

Some one i know now has the Netsky cos ferrari think i'm sending them the virus :eek:

Scanner at work here picked it up easily. Dunno if same thing but i;ve been getting virus spam trying to send me "my details"

[Peadar]

I got the Netsky D version sent to me to today

I got Netsky P yesterday in my Hotmail.
Had to laugh because it was sent from a guy in Microsoft which must mean someone there is infected.

[pete]

I'm too lazy to bother checking details on but from what I heard getting mail from someone can meerly mean someone else with their mail addy got it...

[dahamsta]

What pete said. These viruses and worms scan your computer for files with email addresses in them, particularly Windows address books. Then they start churning out email with spoofed headers using the addresses they found, and of course clones of themselves attached. Some of them also make addresses up.

So it's possible that you received mail from just a randomly generated address, or a user that had a microsoft.com address in their address book.

Think about all the crap in your address book that was automatically added by Outlook when you sent or received mail...

adam

[Peadar]

from what I heard getting mail from someone can meerly mean someone else with their mail addy got it...

I know the guy and he did get the virus.
Opened it on Webmail and infected his PC.

[Dodge]

Just o clarify. Someone has to open the attachment for the virus to infect??

Got a few on webmail accounts and just deleted them straightaway...

[pete]

Just o clarify. Someone has to open the attachment for the virus to infect?...

Me no expert but would say as a general rule..Yes.

[Peadar]

Someone has to open the attachment for the virus to infect??

You'll get the technical overview of Netsky . S here. (http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.s@mm.html)

[Peadar]

Just got Netsky.P from "support@symantec.com" :D

Sender of the infected attachment: support@symantec.com
Subject of the message: Re: Submit a Virus Sample
One or more attachments were deleted.
Attachment signature.pif was Deleted for the following reasons:
Virus W32.Netsky.P@mm was found.

[pete]

Sender, InterScan has detected virus(es) in your e-mail attachment.

Date: Tue, 06 Apr 2004 14:59:35 +0200
Method: Mail
From: <petes mail account>
To: ardelli@ferrari.it
File: found.zip
Action: clean failed - deleted
Virus: WORM_NETSKY.B