Puzzled by W32/netsky virus

[The PIT]

How the hell does send mail by a program such as Pegasus mail? Its mainly text based although you can use html with it. Most people are using version 3.12.

It's interesting that in some cases theres no registry setting to launch the program but the infected files are in every folder marked share plus a few others. Others have the registry entry too launch the virus but the virus hasn't dropped the files in the shared folders.

The only good news is Mcafee, Sophos can see this bugger and if updated can kill it.

The record number of files I've cleaned from one machine stands at just over 6700.

[High_Jumbllama]

It has its own SMTP engine. Once activated/opened it runs in the background and amongst other things send the email all on it's own.

Check item 11 Here.

[The PIT]

Thats w32.netsky.c doesn't look like version b does that.

[breezer]

netsky b is a complete bugger, I have has over 300,000 instances of it on the network, sophos is going as quickly as it can but it will still take a few days to purge completely.

[The PIT]

Sophos is a bit pants sadly. On a mailhubs it decides to let the odd one through even though it's been updated. Worrying.

The record number of dumped files so far is 10620. Anyone beat that???

[Gurm]

Antivirus programs are all pants lately. I don't know what is up, but nobody has written a GOOD antivirus program in years now. AVG is the closest I've come, and even that succumbs to the "weird new interface that nobody can use" bug.

Norton Corporate is good, from what I hear.

- Gurm

[The PIT]

Originally posted by Gurm

Norton Corporate is good, from what I hear.
- Gurm

I've only seen the old version 2002. For some reason it had failed too update the virus signatures for six months. The person responisble for it had left and of course no instructions were left etc.

The new person managed too find the password and after a little of playing it updated the virus signatures. Strange it took two reboots for it too suddenly decide it had.

Even wierder it had detected and quarentened mydoom even though the signatures were out of date. Dunno how it did that. So after updating when scanned all the pc's on the network they were already clean.

[High_Jumbllama]

Originally posted by The PIT
Thats w32.netsky.c doesn't look like version b does that.

(wording)

Both C which I have a link for above and B both have the engine.

[Gurm]

Because Norton uses heuristics. All new scanners do, but Norton Corporate is particularly... thorough.

- Gurm

[cbman]

We Have The Norton Corporate Here At Work And Its Definately Good... For The Most Part On The Networked Machines You Don't Even Know It Is There... And We Haven't Had A Virus Make It Through Since We Replaced Whatever Program It Was We Were Using Before.

[Wombat]

Originally posted by cbman
We Have The Norton Corporate Here At Work And Its Definately Good... For The Most Part On The Networked Machines You Don't Even Know It Is There... And We Haven't Had A Virus Make It Through Since We Replaced Whatever Program It Was We Were Using Before.

However, the network scanner automatically capitalizes the first letter of every word you type.

[Belwarrior]

I Used To Do That Myself...
nowadays i am too lazy to press the shift when required..
but the reason i give is that i am now too used to unix.. hehe

[DentyCracker]

Norton Corporate is the only Symantec product I recommend to anyone. It is pretty decent. Kaspersky has been doing well on my home machine. AVG 7 seems good too, but I haven't tested it extensively

[The PIT]

Originally posted by High_Jumbllama
(wording)

Both C which I have a link for above and B both have the engine.

Doh missed that. No.10

[cbman]

Yeah.... the capitalization is a bad habit I picked up along time ago in school when I was learing how to touch type and use the shift key. Hows that go anyways... The quick brown fox jumps over the lazy dog?