Internetworkers: http://www.ibiblio.org/internetworkers/

[Ron Thigpen <rthigpen AT nc.rr.com>]

Thomas Beckett wrote:

> I have a bad virus problem that I cannot figure out.  I'm desperate, 
> because it has screwed up my mail client.

Thomas,

Are you sure that Netsky has infected you? I don't believe Mozilla has
the flaw that this virus depends on for infection. You may well have a
saved mail message that contains the virus, but not been infected.
Norton is finding it in your mail file, not elsewhere, no?

Try to find other evidence that the virus was executed.

Look for presence of %Windir%\SysMonXP.exe (28,008 bytes).

Look for the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
with a value of:
"SysMonXP"="%Windir%\SysMonXP.exe".

If these aren't present, chances are the virus never ran and your
symptoms are unrelated.

There are other possible explanations for your symptoms.

Mozilla uses mail files w/o any extension to store the raw mail data. It
also generates a related mail summary file containing header/summary
data. These files have the same name as the mailbox file, but also have
a ".msf" extension. Under certain circumstances, these files can be lost
or corrupted. Usually this is no big deal, Moz simply builds a new one.
As they are entirely based on information contained in the raw mail
file, nothing is lost in the process. The rebuild process can be a bit
slow, especially for large mail files, and definitely entails intensive
disk access. Yes, 600MB is a large mail file.

Take another look into "C:\Documents and Settings\T Beckett\Application
Data\Mozilla\Profiles\default\ag50m5dl.slt\Mail\". Is there an MSF file
present?

If you're not infected, and are just shy one good MSF, it should be safe
to load Mozilla and let it rebuild your MSF. Once that's done, sort your
mail based on attachment size and see if you can't find the infected
mail and delete it. And for performance' sake, you may want to come up
with some sort of mail archive scheme.

hth,

--rt