Vanity: Is anyone else getting hit with "Netsky"?

4/30/04 | Redcloak

[Redcloak]

Is anyone else getting hit by emails infected with "Netsky"?

Over the past week, I've gotten about a dozen messages with the W32.Netsky.Q@mm worm. (Norton makes quick work of them, however.) A few have had return addresses from some of my customers' domains, but the worm can spoof the return address. Symantec's page on the worm is here.

I've gotten two thus far today and one automated response from a server where my email address had been spoofed. Is anybody else seeing this worm wiggling in their inbox?

[mlbford2]

This is the 1st week I have not had one virus sent to me. Usually I avg about 10/wk. Which is not that many compared to some.

[SheLion]

I get about 25-30 of these a week. Thank God for Norton. Zaps the virus in the attachment before it's sent to me.

Even though I never open attachments.

[tacticalogic]

I'm still getting about 10 a week. I send 'em on to their ISP.

[bayourod]

Not until you posted this.

[kddid]

Me too.

[DefCon]

I do not use outlook as a mail client.
I use a web-based mail service only.
I am getting fewer of these this week than last.
It was 2 0r 3 a day last week, only 2 or 3 total this week.
Some are messages with infected attachements.
Some are 'send' errors from various postmasters
rejecting mail that was spoofed w/ me as the sender.
I suspect somebody w/ the virus has my email address in their address book.
I tried warning my contacts, but most of them are not very computer savy,
and most of them just respond w/ a ?huh?.

[R. Scott]

I thought I was the only one getting dozens a week. I use Cox Cable service with an automatic intercept on Email. The infected message never gets to me, just a message from Cox telling me it was intercepted - and if I would like to “click here” I can get it (yea - right!).
I’ve been running Norton every few days, but Cox seems to get them all.

[mlmr]

If you are talking about the virus that tells me that my domain is sending out unsafe mail, I get bombed about forty times a day.

[tacticalogic]

I suspect somebody w/ the virus has my email address in their address book.

If you check the headers, you can find the ip address it came from (it will be the ip address in the Received From: line added by the first mail server it hit at your ISP - everything before that is a lie). You can take that and go to www.dnsstuff.com to find out which ISP owns that address. Forward it to abuse@ that ISP. They can check their logs and find out who it's coming from.

[battousai]

We see a few hundred a day on my work network, but we have a pretty robust gateway antivirus and firewall solution so nothing gets through. This is actually down from when MyDoom hit the internet we would see several thousand hits everyday of that virus :)

[goodnesswins]

Same here...first week WITHOUT netsky.....but my ISP instituted BARRACUDA something.....and must have found a way to take care of them....I didn't even get any notifications from them this week that they'd caught anything! (Maybe they decided not to bother with the notifying....it was an irritant anyway.)

[angcat]

I have been getting spammed all week. One email that was sent to me has my address but with a 3D in front, how can this get to me if it has the wrong email address?

[SheLion]

I'm still getting about 10 a week. I send 'em on to their ISP.

How do you do that?

[tacticalogic]

See 10.

[SheLion]

Me too.

It's disgusting. At first, I got really mad. Then I just block sender or delete the stupid stuff. But it sure takes up time that I could put to better use.

[SheLion]

See 10.

I just did. I copied and pasted and saved the info. Thanks!!!! :)

[tacticalogic]

Use the IP Whois to find out who's network it's coming from. Works for regular spam, too, but if it traces back to China or one of the former Soviet republics (lots of them do), it's probably a waste of time to report it.

[Oystir]

I have been getting the microsoft "patch" thing from russia 2-3 times a day - driving me nuts as I get almost no spam.

[Psycho_Bunny]

No. 

You probably wrote it. 

I'm calling the FBI.