NETSKY.P

[VBmim]

Hello everyone

Lately, we are receiving a lot of mails infected with Netsky.P . The infected attachment is removed by our anti-virus software.
The email itself contained following body:


If the message will not displayed automatically,
follow the link to read the delivered message.

Received message is available at:

http://www.oursite.com/inbox/person_name/read.php?sessionid-32289

[i/]

Now, as a user was showing me this 'strange' email, he clicked the link that was in it. What exactly happens when you click this link? I have found many explanations on how to remove the virus if the attachment was open, but that is not the case here...

Greetz

VBMim

 

[SESaskDFC]

Howdy:

Go to the following url and then to Technical Details...

http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.p@mm.html

Murray

 

[Xemus]

Bear in mind that the worm uses the Incorrect MIME heads vulnerability, so you don't need to open the attachment to get it. Seeing it with the preview pane turned on will infect a vulnerable system.
Windows update ran on that system lately (the update came out a while ago)? If not, you may have it.

http://www.closedsocket.com