Backdoor netscape virus

[maxGD059]

It's friday afternoon, I'm on my own at work (buisness partner holidaying in france). Its busy, no infact it's frantic & what happens, well sh** actually. The network goes down with the above mentioned virus. How its happened well GOK but it has. The usual spyware kit can isolate it but can I get into the Registry to delete it? By heck I can. As soon as I go into the Register Editor then the Editor closes before any chance to sort it. Frustrating or what. At least I've got 3 days to forget today which may as well have been friday 13th. Any ideas guys, to make tuesday morning half bearable?

[wilf]

nope - you are shafted. LOL

let's go for a beer instead.

[maxGD059]

Done that already, x3 infact as I've realised my local has got Tanglefoot as a guest beer. Oh, and also had an excellent curry but not from the pub. Feeling better now -sod work.

Talking of which Wilf, how's tricks?

[wilf]

Richard - you have email.

[maxGD059]

Wilf

Good to hear from you & have returned your email. It's amazing stuff that Tanglefoot. It made me forget I'd actually had 4 or was it 5 of them, & then typed in the virus name incorrectly
Its the Backdoor Netsnake virus.

(rather appropriate on the CRC forum!)

Probably just as much of a case of FUBAR methinks though

[kdavies3]

Here is some infomation you may find helpful: from: http://www.sophos.com/virusinfo/anal...netsnakeh.html

Troj/Netsnake-H is a backdoor Trojan.

In order to run automatically when Windows starts up the Trojan copies
itself to the file iexplore.exe in the Windows system folder and adds the following registry entry pointing to this file:

HKLMSoftwareMicrosoftWindowsCurrentVersionRunmssys int

Troj/Netsnake-H also drops the file psinthk.dll into the Windows system folder.

i guess you are tryin to remove this registory entry:

HKEY_LOCAL_MACHINE entry:

HKLMSoftwareMicrosoftWindowsCurrentVersionRunmssys int


but as for the registry closing on its own thats a puzzler.

Which Anti-Virus Program are you running?

[maxGD059]

Kev

Thanks for your thoughts. Think we run Mcafee at work which is now a zillion miles away as its bank holiday w/e thank goodness. Looks like the brown stuff will hit the fan on tuesday, but till then, well, I think I do some fly scraping of the screen in preparation for donnington!!

[robert]

Richard

Give me a call on the number in the mag, I can point you in the right direction. :thumb:

HTH

[Miket]

Originally Posted by robert

Richard

Give me a call on the number in the mag, I can point you in the right direction. :thumb:

HTH

Where to, Donnington :thumb: :thumb:

[maxGD059]

Thanks Rob. I wasn't looking forward to tuesday!