Vanity: Is anyone else getting hit with "Netsky"?

4/30/04 | Redcloak

[Redcloak]

Is anyone else getting hit by emails infected with "Netsky"?

Over the past week, I've gotten about a dozen messages with the W32.Netsky.Q@mm worm. (Norton makes quick work of them, however.) A few have had return addresses from some of my customers' domains, but the worm can spoof the return address. Symantec's page on the worm is here.

I've gotten two thus far today and one automated response from a server where my email address had been spoofed. Is anybody else seeing this worm wiggling in their inbox?

[tacticalogic]

I have been getting the microsoft "patch" thing from russia 2-3 times a day - driving me nuts as I get almost no spam.

That's probably intentional. The virus installs a backdoor on your machine, and the spammers then use it to send their crap. It's called a "spam zombie".

[devane617]

I have had at least four hits today from this virus. McAFee is catching them, but it is an issue.

[devane617]

Another item that I am having tons of problems with is "Port Scans". My Firewall is logging the activity, but it is more than I can make reports on to the ISP(s). I have several hundred in the past two days alone.

[SandRat]

Let me join mlbford2's statement. This is the first week I've not been hammered by a daily barrage of incoming infected emails.

[TechJunkYard]

We had a bunch of these coming from some charter.net customers. Charter finally took some of them offline. I haven't got a single one so far this week.

I run Linux, so I don't have to worry about 'em. But they clog up the inbox anyway, and I report every one of them.

[SheLion]

Use the IP Whois to find out who's network it's coming from. Works for regular spam, too, but if it traces back to China or one of the former Soviet republics (lots of them do), it's probably a waste of time to report it.

Ok! Thanks so much!

[tacticalogic]

We had a bunch of these coming from some charter.net customers.

Same here. Adelphia.net seems to have a nest of 'em, too.

[razorback-bert]

Ditto, now if Cox would do something about the spam.

[amigatec]

I have had about a dozen of these over the last couple of weeks and I run Linux!!!

At least 6 were Netsky-p the rest I am not sure.

[tubebender]

Dittos...Cox has started deleting them lately but I do some buying on eBay and I wonder how many of those dealers machines are trojans...

[Cicero]

Norton does a great job on it. Be sure to update at least once a week.

[m87339]

what the heck was that?

My Nortron kicked in right away and said I was under virus attack!!!!!

[cgk]

Thanks for providing this info. I've wondered about this awhile. Wonderful. It'll work for those Nigerian scam letters, too, yes? Wee!

[IamHD]

I've never gotten a virus. What is usually in the subject line, or the headers? I guess I've been lucky.

[cgk]

Thanks for providing this info. I've wondered about this awhile. Wonderful. It'll work for those Nigerian scam letters, too, yes? Wee!

[mlbford2]

my AVG kicked it out. this guy is some kind of turd who posts screwed up links. put his name in 'search' author. that's all he does.

[arasina]

Same here. A lot of port scans and then spam follows. I gave up reporting them to the ISP because nothing happens as a result of the reports.

[arasina]

The link you provided is infected with a virus, according to my Anti-Virus Guard.

[Redcloak]

I hope that you have an anti-virus program. Luck has a way of running out.