New Netsky Variant

[mattjurado]

Just wanted to let everyone know, I have a new virus sitting in my inbox that nothing picks up on, and I have scanned the heck out of it (Norton Antivirus, F-Prot, Hauri, Trend). The subject name and attachment indicate that it might be another Netsky variant. I know Netsky.D is the big one today, but I have Antivirus detecting that already. Anyways, its fast spreading, so make sure the word passes not to open pif files, and filter the extension, unless you are in the rare niche of receiving real dos pif files.

Matt J.

P.S. Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[mattjurado]

Update...

Turns out it is the Netsky.D variant, just appears as though some virus scanners are having a difficult time identifying the virus signature, even with the latest updates. Some of the scanners used are not Windows based, so the virus is not manipulating them, just looks like Netsky.D was written to be difficult to identify.

Matt J.

P.S. Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[fluxvoovoo]

Yeah Matt, I scanned a known netsky .pif file yesterday with a Norton Corporate, that is supposedly current (aren't they all...) and it completely missed it. I wonder if we've only seen the tip of the iceburg with this one when It comes to payload. Sure seems like the author went to a lot of trouble with this one in regards to transference as compared to bang at the end.