W32/Netsky.d.eml!exe virus keeps attempting to attack inetinfo.exe within IIS

Posted on 2006-05-07
Last Modified: 2012-05-05

Hi Guys,

I have problem where the above virus keeps trying to attack inetinfo.exe. Its not being successful as IIS still works ok. However the virus scanner i am using which is MCAfee VirusScan Enterprise 8.0! keeps reporting that it finds the virus, but failed to move or delete it.

I have to manually browser to the folder and delete the relevant file.

Is there anything i can do from an IIS point of view to prevent this occuring?

The package that is being used on the Windows 2000 IIS Server is GFI MailSecurity that uses IIS. The pachage is an email content checking package that scans all inbound/outbound emails for viruses using Norman Anti-Virus and a few others. The MCAfee virus scanner, protects the Windows 2000 OS.


Question by:biggiesmallzz
    LVL 16

    Expert Comment

    Hi there biggiesmallzz,

    Have the server been infected with the virus?  W32/Netsky.d removal tool:

    Are your virus definitions for GFI MailSecurity upto date?  As this should be preventing it affecting your Server and your clients.  

    LVL 17

    Expert Comment

    Please visit to download the stinger tool. Once done run it with the repair option.
    Mcafee may not be able to remove it normally. You may need to boot in safe mode and run the virus guard.
    Always run the first scan as repair. It will give you an idea of whats infected and safeguard against accidentally deleting required files.

    Author Comment

    I ran the Symantec netsky removal tool and it did not find any variants of the virus.

    The Mcafee tool i could not find.

    LVL 17

    Accepted Solution

    try at

    It will be there.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    A high-level exploration of how our ever-increasing access to information has changed the way we do our jobs.
    Let’s list some of the technologies that enable smooth teleworking. 
    This video shows how use content aware, what it’s used for, and when to use it over other tools.
    The viewer will learn how to successfully download and install the SARDU utility on Windows 8, without downloading adware.

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now