Normsweb Virus Warning Page

FEEL FREE TO COPY OR DISTRIBUTE THIS INFO, JUST MAKE SURE I GET THE CREDIT. (Norm of Normsweb.com)

After formatting my system and backing up all valuable data, I decided to deliberately infect my computer with the NETSKY VIRUS -Just to see what it does! (I figured that the worse it could do was destroy my hard-disk, which could do with upgrading anyway).

======================
Far as I can tell, it does no harm at all to your computer, but makes it look as if you have been downloading porn and other illegal stuff from websites.

It creates 82 files, all 29 kb, Then copies them to every directory with UPLOAD, DOWNLOAD or FTP in the name (upper or lowercase). All sub-directories of those also get the same 82 files and so on. The file names are mostly associated with porn or other illegal activity. One is called "Netsky source code".

Next It creates an entry in the registry so that if you delete all the files, when you restart, they magically all re-appear.

To find out if you have been infected, goto START MENU / SEARCH and type in NETSKY SOURCE CODE. if it is found, then you have been infected. If nothing is found, you are clear.

Goto start menu, click RUN..., Type in MSCONFIG then click ok. When MSCONFIG appears goto the STARTUP tab. de-select FVPROTECT.EXE then close MSCONFIG. Re-start computer when prompted.

After restart it will warn that you have messed with startup settings. Cancel that message and close MSCONFIG. Goto your WINDOWS folder (usually C:\windows) and delete FVPROTECT.EXE

Next, Goto RUN... and type in REGEDIT. When Regedit appears find this key: HKEY_LOCAL_MACHINE /SOFTWARE / MICROSOFT / SHARED_TOOLS / MSCONFIG / STARTUP_REG. In STARTUP REG you should see a key called NORTON ANTIVIRUS AV. Delete NORTON ANTIVIRUS AV key, close regedit and restart your computer. After restart and closing MSCONFIG again you will get prompted to restart your computer again. This is because you have just removed the registry entry and upon restart MSCONFIG has changed its settings. Restart the computer again. When MSCONFIG pops up, confirm that NORMAL STARTUP is highlighted then close MSCONFIG. If you are prompted to restart, click EXIT WITHOUT RESTARTING.

Finally, and this is the time consuming bit, search through every directory with UPLOAD, DOWNLOAD or FTP in the name (upper or lowercase) including all sub-directories and delete all suspect files. DO NOT GET TEMPTED TO CHECK ANY OF THE FILES, if you are unsure about which to delete, just leave then there. if you attempt to access any of the 82 files you will re-infect yourself and have to start again.


	IMPORTANT E-MAIL VIRUS INFO: It has been brought to my attention that people have been receiving e-mails supposedly from "The Normsweb.com team". These e-mails always have attachments. THE ATTACHMENTS CONTAIN VIRUSES do not open the attachment under any circumstances. The e-mails are not sent from normsweb.com If you receive an e-mail from anybody@normsweb.com and you are not expecting one, DELETE IT IMEDIATLY! I have reported this to the Netfirms support team (they host my website), who were very helpful and sent this reply: "The email issue you have reported is most likely due to the Netsky virus that has been making its way throughout the Internet recently. Numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to another individual. We have made some modifications to our mail server to minimize the occurrence of these e-mails." For more information about this virus please visit: http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.v@mm.html "As with any virus e-mails, we suggest that you do not open any e-mail attachments unless you are certain that they are legitimate. Further, we recommend that you install an Anti-virus software and and update it regularly with the latest virus definitions."

	NETSKY VIRUS: HOW TO REMOVE. FEEL FREE TO COPY OR DISTRIBUTE THIS INFO, JUST MAKE SURE I GET THE CREDIT. (Norm of Normsweb.com) After formatting my system and backing up all valuable data, I decided to deliberately infect my computer with the NETSKY VIRUS -Just to see what it does! (I figured that the worse it could do was destroy my hard-disk, which could do with upgrading anyway). First I found out what it does: ====================== Far as I can tell, it does no harm at all to your computer, but makes it look as if you have been downloading porn and other illegal stuff from websites. It creates 82 files, all 29 kb, Then copies them to every directory with UPLOAD, DOWNLOAD or FTP in the name (upper or lowercase). All sub-directories of those also get the same 82 files and so on. The file names are mostly associated with porn or other illegal activity. One is called "Netsky source code". Then It creates a file within the Windows directory called "FVprotect.exe" Next It creates an entry in the registry so that if you delete all the files, when you restart, they magically all re-appear. To find out if you have been infected, goto START MENU / SEARCH and type in NETSKY SOURCE CODE. if it is found, then you have been infected. If nothing is found, you are clear. Then I figured out how to remove it (manually): ===================================== Goto start menu, click RUN..., Type in MSCONFIG then click ok. When MSCONFIG appears goto the STARTUP tab. de-select FVPROTECT.EXE then close MSCONFIG. Re-start computer when prompted. After restart it will warn that you have messed with startup settings. Cancel that message and close MSCONFIG. Goto your WINDOWS folder (usually C:\windows) and delete FVPROTECT.EXE Next, Goto RUN... and type in REGEDIT. When Regedit appears find this key: HKEY_LOCAL_MACHINE /SOFTWARE / MICROSOFT / SHARED_TOOLS / MSCONFIG / STARTUP_REG. In STARTUP REG you should see a key called NORTON ANTIVIRUS AV. Delete NORTON ANTIVIRUS AV key, close regedit and restart your computer. After restart and closing MSCONFIG again you will get prompted to restart your computer again. This is because you have just removed the registry entry and upon restart MSCONFIG has changed its settings. Restart the computer again. When MSCONFIG pops up, confirm that NORMAL STARTUP is highlighted then close MSCONFIG. If you are prompted to restart, click EXIT WITHOUT RESTARTING. Finally, and this is the time consuming bit, search through every directory with UPLOAD, DOWNLOAD or FTP in the name (upper or lowercase) including all sub-directories and delete all suspect files. DO NOT GET TEMPTED TO CHECK ANY OF THE FILES, if you are unsure about which to delete, just leave then there. if you attempt to access any of the 82 files you will re-infect yourself and have to start again.

	DISCLAMER: Whilst every effort has been taken to ensure any available downloads have been scanned for viruses and are safe, this process can sometimes fail. Neither Normsweb.com or Norman Green will be held responsible for any damage to any software that may arise from downloading files from this site. I have no control over the content of other sites listed on the links page and cannot be held responsible for their content. If it is brought to my attention that a linked site contains content which is not considered legal and decent, it will be removed forthwith.