Virus Alert: NetSky.B

[DjM]

Symantec just posted production def's:

Symantec Security Response has posted LiveUpdate and Intelligent Updater
virus definitions containing detection for W32.Netsky.B@mm. This Netsky
variant was discovered on February 18, 2004 and is rated a Category 3
threat. The definitions have a version number of 60218g (20040218.007) and a
Seq Number of 27997.

Have fun.

/edit
And last but not least, the removal tool from Symantec:

Symantec Security Response has posted a Removal Tool for W32.Netsky.B@mm.
The Removal Tool is available for download from the following location:
http://securityresponse.symantec.com...oval.tool.html

Cheers:

[Soda_Popinsky]

Uh oh! Netsky?? SkyNet! Its Judgement Day!!! Wheres Arnold when you need him?

[SirDice]

Originally posted here by HTRegz
Symantec doesn't make any mention of it open up ports, has anyone else seen evidence of this other than SirDice.. or can you confirm SirDice (perhaps and netstat -aon on the infected machine).... I'm wondering if I should be adding more ports to my res sweeps.

I probably overlooked it in my rush to get the info out. As far as I know NetSky doesn't open any ports.

[SirDice]

It turns out that if you updated your virusscanner after you've been infected, your virusscanner will not detect the infection. You'll need to download one of the removal tools to get rid of it.

[gpshewan]

I spend a lot of time online, and something just doesn't "feel" right today. Okay some server a little way down the line may be having a bad day, but a check at the Internet Storm Centre shows a large increase in activity for the worm netsky (ranked as server by Symatec).

I've posted somewhere else regarding spammers and virus writers getting together more and more, and IMHO being slammed by a mass mailing worm is going to become a regular occurance. Last night I had about a 50% increase in the number of spam mails captured by my filters.

<rant on>
Jeez I wish people would get a clue and sort out their PC security. I am officially pi**ed of today.
<rant off>

Internet Storm Centre diary entry

Netsky.b entry at Symatec

[SirDice]

It already fully covered here

[gpshewan]

F**k! Missed that looking through the red mist. And I hate multiple posts...

Cheers.

[Negative]

*Threads merged*

[gpshewan]

Thanks Negative...

[DjM]

I don't know about you guys/gals, but I think this guys comments may be a little premature:

The Netsky-B worm took off quickly but has crashed back down to earth.

Full Article

Now, I agree, this is not even close to the Mydoom outbreak, but I am getting at least one hit of this virus every 3 to 4 minutes.

I was planning on upgrading my AntiVirus management server this weekend, but because of Mydoom & Netsky, I think I'll be putting that off.

Cheers: