Netskyb virus...

Quote:

---

A mail message with subject "fake" has been found containing
a virus and has been deleted from our systems.

The message was sent from anotherrubbishrubbishrubbishrubbishrubbishrubbish@hotmail.com to the following:
mark.jacob@environment-agency.gov.uk


The Agency's email gateway is blocking the virus and informing staff as these
emails are intercepted. As such, Agency computer systems should remain
unaffected. No action is required from Agency staff at this time, therefore
you do not need to raise a Help Desk call.

However, if you require more information about this message and you are an
Agency employee, please contact the CIS Help Desk, otherwise please contact the
Environment Agency on 0845 9333111.

Further information on this virus:
Scenarios/Incoming/Sophos Sweep: A virus has been detected: 'W32/Netsky-B'.
Scenarios/Incoming/Sophos Sweep: A virus has been detected: 'W32/Netsky-B'.
Scenarios/Block All Executables: 'Selected'.



Regards

System Administrator
Environment Agency

---

er? how would that have happened then, spoof e-mail or what, i dont use outlook - its not even set up, only use the webmail version of hotmail.. :confused:

mark

One of the problems with email is that it does not authenticate the sender in any way. When an email is sent, the sender can purport to be anyone on the internet, and the receiver assumes they are not lieing.

That mail is probably from a virus that has infected a machine that has your address in the address book. You can ignore it.

Quote:

---

That mail is probably from a virus that has infected a machine that has your address in the address book

---

hmmmmm, well aslong as its nothing to do with me its ok :)

or your machine is infected, and it was sent from yours... again the address would be faked, its too much effort for virus writers to bother going through hotmail, and then theyd need your passwords and such... a virus scan of some kind might be good idea for you..

I know that address. I'm pretty sure its from a hexus user.

Either :
a) They have been infected by a virus, and it has emailed itself to you, or
b) Its somone else infected, and the virus has spoofed the email address by seeing it on a webpage (most likely here, as like i said, I'm pretty sure its someone from here)
c) you are already infected. But i doubt it would be mailing it to yourself if this was the case. A scan is always worth while though :)

Quote:

---

I know that address. I'm pretty sure its from a hexus user

---

which, the hotmail address? that would be my e-mail address... or do you mean the agency one?

mark

Its a report generated by spoofing - dont worry about it.
I hate these reports, they do more damage than good (we try to configure our AV scanners to only sent reports internally )

Indeed.... The other classic scenario is Spoofed email recieved, so Company Passes it back, complete with Virus to (alledged) sender.

When will these muppets learn? Mail storm in the making when Company A passes it back to Company B, who passes it back to company A...... ah the joy!

somehow the netsky-d virus has slipped past AVG so i'm having to get rid of it now.

elmo - go write 101864278463287 times:

"I must not open unsolicited attachments"

i didnt tbh, i've got 2 virus checkers on my emails and i never open the email attatchments unless i'm expecting them. so that's not how it got in :s

Why do I NEVER get any of these viruses at all??

It's just not fair :(

I've been getting quite a few of these emails, usually with a message saying that outlook has blocked access to the attached *.pif file :D

Most vexing about the address spoofing though :/

Quote:

---

Originally Posted by Elmo

i didnt tbh, i've got 2 virus checkers on my emails and i never open the email attatchments unless i'm expecting them. so that's not how it got in :s

---

Ah it must have been the magic virus fairy then ;)

Some of them can spread via p2p networks, but ALL rely on you running the attachment.

(note: I'm referring to the Mydoom/Netsky worms here )

Given that this virus is mutating at least once a day , its quite possible that you recived a copy of it before your AV kit updated.

Screen shot posted by a friend of mine, the result of netsky:

http://eldren.freeshell.org/5817_mes...ci_dot_net.png


Myself, I've received 8 of these, the past week. Which is rather amazing, because this is the first time I've received an email virus in the 4, 5 years I've had this email address. There goes my streak. :/

I think I may have had this

Been getting stacks of these just recently, mostly sent to my domain which then defaults to me :(

So I changed the forwarding e-mail to a msn one so that I would.'t have to keep looking at the blighters and just incase one of the kids opens one by mistake.

Also deleted one of my older e-mail addys as that was getting nothing but trash as well.
Just seems to me to be getting out of hand recently, esp having to warn our own members when we had a similar e-mail to the one hexus had.

Ohh the joy of e-mail I suppose :eek:

recieved 1 the other day and now got 2 today ,which really pee's me off cause cause im now getting more viruses than spam!!!!

thankfully norton kills it dead before it can do owt

1 of the ones i got today supposedly came from psycho@pc-extreme.co.uk (genuine email addy although i doubt it really did come from him mind)

so where the hell are they coming from tho? or is it from morons that dont have any antivirus protection and its using their adddress book?

its spreading all over the place atm :/ my uni network was down over the weekend because of it

But one thing tho - its not a virus, its a worm; or rather a group of worms which are packaged together for delivery and then separate out on the victims machine/network