Virus Warning :: Nyxem.E

[horseUSA]

The destructive deadline of the Nyxem.E worm is based on the clock of the infected machine. So if you're infected and your clock is not set right, things could start to happen at any time - even though the official activation time is the 3rd of the month. We've already received first reports from users who've had files on their system overwritten by the worm.

nyxem_killed

When Nyxem activates, it will overwrite all of your DOC/XLS/PPT/ZIP/RAR/PDF/MDB files. This is nasty, as this is done on all mounted drives, ie. any drive that has a drive letter. So it might affect your USB thumb drives, external hard drives and network drives! Also, if you're taking daily automatic backups you might end up backing up the corrupted files over good files.

The number of machines that have been infected by this worm is over 300,000. Many of those have been disinfected already, though. But thousands of computers will get their files overwritten on February 3rd - most of them in India, Turkey and Peru.

This worm family has been around since March 2004. The worm is named "Nyxem" because the original Nyxem.A variant launched a DDoS attack against the New York Mercantile Exchange website (www.nymex.com). We don't know why.

http://www.f-secure.com/weblog/archives/archive-012006.html#00000797

I would run a scan just to make sure you do not have this one on your system.
Free online scanners:
http://housecall.trendmicro.com/
http://www.kaspersky.com/virusscanner
http://www.pandasoftware.com/activescan[/quote]

 

[evangilder]

Good info, Horse! Thanks.

 

[Milos Sijacki]

Thanx for the info

 

[DerAdlerIstGelandet]

Yes very cool, thanks.

 

[denisfife]

This is a nasty little worm with a number of aliases

Symantec calls it the W32.Blackmal.E@mm worm and has a free removal tool on its website at:

W32.Blackmal.E@mm - Symantec.com (copy and paste to browser) 8)

 

[ccheese]

Welcome to the forum, denisfife ! Geeze, just what we need....
Another digger !! You'll definately be among friends...

Charles

 

[Njaco]

I do believe I smell canned meat product.

 

[wilbur1]

What do you mean nj?

 

[Njaco]

Wow! The first time I came on this thread there were no posts showing from Horse and the others. Just started with Denislife. Thats why I posted what I did, thinking it was spam. Freakin computer!!

 

[Thorlifter]

thanks for the info Horse. I'll make sure my Sophos is up to date.

 

[Freebird]

Never heard of the worm. I wonder if it is still floating around.

 

[Elvis]

Is this what happened to the forum last week?

 

[Catch22]

I doubt it.

 

[Matt308]

closed