Help. How Do I Kill This Virus

[Thetyim]

On 10/5 I opened an attachment called "bill"

On 12/5 two emails were returned to me as they contained virus NetskyZ

I have downloaded a fix from McAfee and run it twice but it stays the virus is not on my computer. I did have system restore disabled.

Can anyone suggest what I should do now.

Can I safely send email again now ?

[Wolfie]

First thing i'd do is scan your machine, there are some free online scanners that seem to be quite good, try This one.

If you find you actually have the virus, then goto This site and download the removal tool.

Hope this helps some

[BlissfullyIgnorant]

It's also possible you don't actually have the virus - an infected machine that has your email address could be sending you the "failed" messages in an attempt to infect you.

[francois]

hi'

First thing i'd do is scan your machine, there are some free online scanners that seem to be quite good, try This one.

If you find you actually have the virus, then goto This site and download the removal tool.

right

just follow this advice.

cheers

francois

[Thetyim]

Thanks for advice.

I have now done a scan using HouseCall, McAfee and Adaware.

All three came up with nothing. I have searched for Jammer2 the virus file name and again found nothing there.

I am sure that I had the virus so where did it go ?

[caughtintheact]

Did you check the email that said you had the virus to see if you knew the addressee and if you actually sent the email in the first place? Many of the viruses these days will harvest email addresses from an infected computer's hard drive(s), then the virus selects one as the originator of emails it sends out. So if someone gets infected and your email address is on their hard drive, and the virus selects your email address as the "from" address, it will look like you sent the email. When an ISP with anti-virus protection catches the email with the virus it will send the bounce back to you as it has no way of knowing that you did not originate the email. So look carefully at the bounced email - if you know the addressee, who it was bounced from, then you might have the virus, but if you do not know the addressee, then you most likely do not have it.

Here's an example of a bounce I received recently - I never heard of the address [email protected], so I disregarded the bounce.

Our virus detector has just been triggered by a message you sent:-

To: [email protected]

Subject: a crazy doc about you

Date: Mon May 10 21:40:47 2004

Any infected parts of the message (image.doc.scr)

have not been delivered.

This message is simply to warn you that your computer system may have a

virus present and should be checked.

The virus detector said this about the message:

Report: image.doc.scr contains Worm.SomeFool.Gen-1

Windows Screensavers are often used to hide viruses (image.doc.scr)

No programs allowed (image.doc.scr)

[Thetyim]

Thanks Caught, I think you may be right.

I have since then received an email and McAfee zapped it as being infected with NetskyZ.

I have run a full scan and appear to be clean now.

[dr_Pat_Pong]

Thanks Caught, I think you may be right.

I have since then received an email and McAfee zapped it as being infected with NetskyZ.

I have run a full scan and appear to be clean now.

Good for you They are a worry aren't they.

[Pink Mist]

Thanks for advice.

I have now done a scan using HouseCall, McAfee and Adaware.

All three came up with nothing. I have searched for Jammer2 the virus file name and again found nothing there.

I am sure that I had the virus so where did it go ?

I had the same thing, jammer2.exe, got it from an email from someone/thing called duenger, important message , high priority. with a zip attachment.

You can see it working in windows task manager, CPU usage is 100% and pute runs slow.

I used house call and it found 2 WORM_NETSKY.Z files and it managed to delete one, but the other wouldnt delete, said it was being used by another process.

Go to windows explorer and look in the unzipped files and look for one called data and delete it.

That worked for me