All Users
Use specified
engine and DAT files
(or later) for detection and removal. In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Stinger
Stinger
has been updated to assist in detecting and repairing this threat.
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
- Terminate the FVPROTECT.EXE process using Windows Task Manager.
- Delete the following files from your Windows directory (typically c:\windows or c:\winnt):
- FVPROTECT.EXE
- USERCONFIG9X.DLL
- BASE64.TMP
- ZIP1.TMP
- ZIP2.TMP
- ZIP3.TMP
- ZIPPED.TMP
- Delete the many copies of the worm dropped on the victim machine, with the enticing filenames as described above.
- Edit the registry
- Delete the "Norton Antivirus AV" value from
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
- Reboot the system
Additional Windows ME/XP removal considerations
McAfee Threatscan
ThreatScan signatures that can detect the
W32/Netsky.p@MM
virus are available from:
ThreatScan Signature version: 2004-03-22
ThreatScan users can detect the virus by running a ThreatScan task using the following settings:
- Select the "Remote Infection Detection" category and "Windows Virus Checks" template.
-or-
- Select the "Other" category and "Scan All Vulnerabilities" template.
For additional information:
Run the "ThreatScan Template Report"
Look for module number #4066
Sniffer Distributed, Sniffer Portable and Netasyst Capture Recommendation:
Due to changing offset for Subject, Mail From, and attachments in the emails sent by this virus, and as it is not a network-aware worm, we cannot create a Sniffer filter for this virus.
Recommendation for customers:
- Create a capture profile with Capture on only SMTP traffic.
- Analyze the traffic for Subject, Mail To, and Attachments in the Decode mentioned in http://vil.nai.com/vil/content/v_101119.htm
to identify if there is a virus propagating from specific IP's.