Netsky is one of those things that spoofs the 'from' address when emailing itself, so the fact that you got the email thing back doesn't necesarily mean that you have sent out a virus (especially if you don't know the alledged recipient, obviously).

The computer problems would be more of a worry, if your definitions are up to date, Norton should pick up that sort of thing. In short, I don't know what else you would do, sorry.

If your computer keeps rebooting, then you could have the Sasser or blaster (or a varient) which does this.

Make sure your anti-virus is upto date.
You have a firewall installed and turned on.
You have all the windows patches installed.

If the machines rebooted before you have a chance to get the updates or do a virus scan here's the temp fix.

Goto to services in the control panel.
double click Remote Procedure Call (RPC)
click the recovery tab
change the action and click ok.

That should stop it rebooted and give you time to clean your machine.

T,

Trying to establish how you got the virus in first place can wait. Most AV products will (if properly up to date) will find any files containing the virus, but if the virus is already active on your system the "trigger mechanism" can be secreted into places like the Window registry, so when you run a scan and get the all clear, it just starts up again - leaving you to chase your tail.

In this case you will need to get your hands on a disaster recovery application. Most of the major AV manufacturers provide such software which can normally be downloaded from their web site. You may have have the problem of your system re-booting too frequently to allow you to get it all downloaded. In this case you may have to rely on someone local to you to get hold of the files in question, burn them on to a CD and then manually copy them onto your machine.

The one I am familiar with can be found Here.

This is what you need to do:-

1. Get the sysclean.com file and the pattern file copied into a folder on your PC. The pattern file will then need to be unzipped before you do anything else.

2. Have a read through the instructions which I am summarising in these steps.

3. As there are a couple of things you need to do to your PC first if you're running Windows ME or XP have a look at these instructions as well. You'll have to go through these steps before you run the cleanup tool and then set them back afterwards. It may be a pain, but because we are dealing with sneaky buggers they use this as a way of re-introducing the virus without you knowing.

4. From step 1, you should now have a folder containing sysclean.com and a pattern file (lpt$vpn.xxx - xxx=pattern number). Run sysclean.com and sit back. This could take an hour or so depending on how quick (and messed-up) your machine is.

5. As mentioned in step 3, you will need to reset the changes made to your system before you ran the sysclean tool.

Fingers crossed you should be OK once it has finished.

As Avenger said, it does sound like a Netsky variant - the faked e-mail is often the tell-tail sign. However, unless you had not gone on to describe the other symptoms, I would have said that it wasn't you who had the problem. A machine affected by Netsky or similar uses an address in its address book as the fake sender address. If you see numerous rejection messages, like the one you received, its not likely to be you, but one of your friends who's been had.

I get that e-mail all the time, but as I use web-based mail I know it to be a crock. There's usually an attachment supposedly of you "message" that contained a virus, and that's where the actual virus will be. There is a removal tool for netsky which I think you can get from symantec.com

Thanks nerdlings

Hopefully that's done the trick

T had a virus.. *keeps a straight face*

(Edited by Stoo 25/05/2004 20:10)

---

by Stoo
T had a virus.. *keeps a straight face*

---

A virus, not the virus