W32.Netsky.C@mm Virus

February 24, 2004

W32.Netsky.C is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. This worm also searches drives C through Z for the folder names containing "Shar," and then copies itself to those folders.

The Netsky.C variant also checks the current system time. If the current system time is February 26, 2004 set between 6 and 9 AM, it executes beeping sounds, which lasts until 9:01 AM.

Virus definitions version 2/24/04 rev 32 (60224af or 20040224.032) and greater detect this threat.

Removal

Symantec has released a removal tool for this virus:
Removal Tool
Removal Tool Instructions

Manual removal Instructions are also available from Symantec at: http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.c@mm.html.

If your computer is still having problems after following the instructions, you will need to format your computer and reinstall your operating system and applications.