Comments on: Protect me from the Kama Sutra!

Question: Protect me from the Kama Sutra!

juggler — Wed, 01 Feb 2006 10:59:59 -0800

Am I safe from the Kama Sutra virus? CNN says it launches on the 3rd. I have Norton Antivirus 2004 and it is updated, but searching the Symantec site didn't tell me anything specific about this worm. I am going to backup all my data tonight, but would like to know all I can about preventing trouble.

By: jerseygirl

jerseygirl — Wed, 01 Feb 2006 11:29:54 -0800

I take it you clicked on an email file attachment, then?

By: juggler

juggler — Wed, 01 Feb 2006 11:31:09 -0800

Not that I know of, but it sounds like I could have ages ago and the virus would it and wait.

By: jerseygirl

jerseygirl — Wed, 01 Feb 2006 11:42:46 -0800

The very basic way to prevent trouble is to not click on email attachments. Especially executables. But in the event of uncertainty, such as your case, the CNN article you linked sums up what your best practice would be in this case. You've already updated your Norton, so that's a good step also.

"And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. "

"... Home users need to be aggressive about questioning e-mail messages and attachments, even if it appears they are coming from colleagues, friends, or relatives. Many e-mail viruses spread by forwarding themselves to everyone in a user's e-mail address book."

By: mediaddict

mediaddict — Wed, 01 Feb 2006 12:02:47 -0800

Symantec says you can check your registry (with Start -> Run -> regedt32, select Options, Read Only Mode) at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for a value "ScanRegistry" = "scanregw.exe /scan". That's the entry that starts the program when you boot up. If you don't have that variable set, you're probably fine. (IANAComputerExpert)

Warning: only look at your registry. Modifying it is risky!

By: smackfu

smackfu — Wed, 01 Feb 2006 12:07:55 -0800

Here is a blog post from the F-Secure guys on it (they call it Nyxem), and a full description.

They have a free cleaner tool explicitly for it, though your Norton should have scanned your files for it anyway.

By: juggler

juggler — Wed, 01 Feb 2006 12:29:09 -0800

Thanks everyone.

By: poppo

poppo — Wed, 01 Feb 2006 12:35:09 -0800

Also, yes Norton will detect it if it's up to date (as the link posted by mediaddict shows)

By: mediareport

mediareport — Wed, 01 Feb 2006 21:47:31 -0800

Thanks for asking this, juggler. I used the cleaner and feel much better knowing I'm not infected. Appreciate the helpful answers here.