Netskyb virus...

[streetster]

A mail message with subject "fake" has been found containing
a virus and has been deleted from our systems.

The message was sent from anotherrubbishrubbishrubbishrubbishrubbishrubbish@hotmail.com to the following:
mark.jacob@environment-agency.gov.uk


The Agency's email gateway is blocking the virus and informing staff as these
emails are intercepted. As such, Agency computer systems should remain
unaffected. No action is required from Agency staff at this time, therefore
you do not need to raise a Help Desk call.

However, if you require more information about this message and you are an
Agency employee, please contact the CIS Help Desk, otherwise please contact the
Environment Agency on 0845 9333111.

Further information on this virus:
Scenarios/Incoming/Sophos Sweep: A virus has been detected: 'W32/Netsky-B'.
Scenarios/Incoming/Sophos Sweep: A virus has been detected: 'W32/Netsky-B'.
Scenarios/Block All Executables: 'Selected'.



Regards

System Administrator
Environment Agency

er? how would that have happened then, spoof e-mail or what, i dont use outlook - its not even set up, only use the webmail version of hotmail..

mark

[DaBeeeenster]

One of the problems with email is that it does not authenticate the sender in any way. When an email is sent, the sender can purport to be anyone on the internet, and the receiver assumes they are not lieing.

That mail is probably from a virus that has infected a machine that has your address in the address book. You can ignore it.

[streetster]

That mail is probably from a virus that has infected a machine that has your address in the address book

hmmmmm, well aslong as its nothing to do with me its ok

[SilentDeath]

or your machine is infected, and it was sent from yours... again the address would be faked, its too much effort for virus writers to bother going through hotmail, and then theyd need your passwords and such... a virus scan of some kind might be good idea for you..

[Agent]

I know that address. I'm pretty sure its from a hexus user.

Either :
a) They have been infected by a virus, and it has emailed itself to you, or
b) Its somone else infected, and the virus has spoofed the email address by seeing it on a webpage (most likely here, as like i said, I'm pretty sure its someone from here)
c) you are already infected. But i doubt it would be mailing it to yourself if this was the case. A scan is always worth while though

[streetster]

I know that address. I'm pretty sure its from a hexus user

which, the hotmail address? that would be my e-mail address... or do you mean the agency one?

mark

[Moby-Dick]

Its a report generated by spoofing - dont worry about it.
I hate these reports, they do more damage than good (we try to configure our AV scanners to only sent reports internally )

[Jiff Lemon]

Indeed.... The other classic scenario is Spoofed email recieved, so Company Passes it back, complete with Virus to (alledged) sender.

When will these muppets learn? Mail storm in the making when Company A passes it back to Company B, who passes it back to company A...... ah the joy!

[Elmo]

somehow the netsky-d virus has slipped past AVG so i'm having to get rid of it now.

[Moby-Dick]

elmo - go write 101864278463287 times:

"I must not open unsolicited attachments"

[Elmo]

i didnt tbh, i've got 2 virus checkers on my emails and i never open the email attatchments unless i'm expecting them. so that's not how it got in :s

[Stubzz]

Why do I NEVER get any of these viruses at all??

It's just not fair

[Stoo]

I've been getting quite a few of these emails, usually with a message saying that outlook has blocked access to the attached *.pif file

Most vexing about the address spoofing though :/

[Moby-Dick]

i didnt tbh, i've got 2 virus checkers on my emails and i never open the email attatchments unless i'm expecting them. so that's not how it got in :s

Ah it must have been the magic virus fairy then

Some of them can spread via p2p networks, but ALL rely on you running the attachment.

(note: I'm referring to the Mydoom/Netsky worms here )

Given that this virus is mutating at least once a day , its quite possible that you recived a copy of it before your AV kit updated.

[eldren]

Screen shot posted by a friend of mine, the result of netsky:




Myself, I've received 8 of these, the past week. Which is rather amazing, because this is the first time I've received an email virus in the 4, 5 years I've had this email address. There goes my streak. :/

[Scrumpyjack]

I think I may have had this