Nyxem worm poised to wreak havoc

Friday is D-Day, but worm may turn sooner

Iain Thomson, vnunet.com 02 Feb 2006

Alerts have been issued by Microsoft and others over the Nyxem.E worm, also called 'Blackworm', 'Mywife', 'Karma Sutra' or 'Blackmal', that is due to start destroying computer files on Friday 3 February.

Nyxem.E is one of the most destructive worms in recent memory and could erase all Word, PowerPoint and Excel files on affected computers when it activates tomorrow.

But some users are already losing data because of faulty time settings on their computers.

"The Nyxem.E deadline is based on the clock of the infected machine. If you're infected and your clock is not set right, things could start to happen at any time even though the official activation is the third of the month," explained Mikko Hyppönen, chief research officer at F-Secure.

"We have already received reports from users who have had files on their system overwritten by the worm."

Microsoft has issued a special alert for its customers, warning them to update their antivirus software. All major antivirus software suppliers have a signature file and some, like F-Secure, also have a specific virus removal tool.

"The worm does not appear to target a security vulnerability, but rather tries to entice users through social engineering into opening an attached file or executable in email," said Microsoft.

"If the recipient opens the file or executable, the worm sends itself to all the contacts contained in the system's address book."

Estimates vary as to the number of computers infected, with some suggesting that up to half a million systems could be vulnerable.

But experts are urging users not to panic. "When you panic, you make mistakes," said Graham Cluley, senior technology consultant at Sophos.

"Sit down and work out if you have done everything you should have done to ensure your computer isn't at risk from the Nyxem worm, and indeed any of the other 120,000 pieces of malware in existence."

See also: