WORM_NETSKY.C or bogus warning mail? 1

[annestahl]

I've been getting lots of e-mails with suspect attachements, which I never open. Now I got an e-mail from someone at CalTrans, telling me that they received a message from me, which was infected with WORM_NETSKY.C. This is their message:

Caltrans virus detection software has found an infected file sent from your
email address. Files that have been successfully cleaned are delivered.
Files that cannot be cleaned are not delivered.
(oaksmtp02)


Date: 02/27/2004 06:49:24 AM
Subject: moin
Virus: WORM_NETSKY.C
File: ranking.zip
From: anne@annestahl.com
To: assner@dot.ca.gov
Action: Uncleanable, Quarantined;

Scanned by ScanMail for Lotus Notes 2.5
with scanengine 6.810-1005
and patternfile lpt$vpn.782


I do have Norton and a firewall, and neither had picked up on any virus in my system, so I checked the symantec site online, and it was very vague about how to tell if you actually have the virus. But I thought, better safe than sorry, and downloaded and ran symantecs removal tool. But it too said there is no virus on my system.

Is the e-mail from CalTrans bogus? Why is there no info at symantec about any such bogus e-mails???

How can I be sure my PC is clean?

Thanks
Anne

 

[sleipnir214]

The email you received from CalTrans is real.

CalTrans sent you the email only because they received an email claiming to have been sent by you. However, Netsky.C forges the "From:" header of any emails it sends. The email was actually sent by someone who has your email in his/her address book.

For more information:
Network Associates' Virus Information Library
Symantec's security response notice


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[annestahl]

of course. that explains it. so many thanks!!!

 

[micker377]

The Symantec program works good (I just cleaned a friends computer that tried to send me the virus), Norton caught it coming in! On hers, the virus even sent itself to her. I told her to notify everyone in her addressbook that she might have sent it to them. If your anti-virus is up to date, you're OK (the signature came out on Tuesday's update).