Nyxem email worm offers trouble in store

In late January, an email worm called Nyxem.E started spreading in computers around the globe but its main payload is yet to drop. Nyxem is also known as Blackworm, Kama Sutra or Mywife. The Common Malware Enumeration (CME) reference for it is CME-24. For those computers infected by Nyxem.E, next Friday and every third day of the month will see the worm replacing the content of a broad range of user's files with a text string "DATA Error [47 0F 94 93 F4 K5]". Among these files are: DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP. The destructive deadline of the Nyxem.E worm is, however, based on the clock of the infected machine meaning that the worm has already claimed its first victims.

Speaking about the Nyxem worm and the initiative to combat it, Chief Research Officer, Mikko Hypponen said: “There are as many as 300,000 computers that are infected – largely in Turkey, Peru and India but also in other countries around the world. They will feel the full force of Nyxem in near time if they don’t take action.”& amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; amp; lt; /p>

Hypponen continued that Nyxem’s capacity to seed destruction in computers without any clear motive or commercial gain was unusual in modern malware but demonstrated that black hats still displayed a wanton desire to cause havoc as they did in earlier years.

F-Secure has shipped a free tool to disinfect machines hit by Nyxem. It is available from http://www.f-secure.com/v-descs/nyxem_e.shtml

For further information, please contact:

F-Secure Corporation
Mikko Hypponen, Chief Research Officer
PL 24
FIN-00181 Helsinki
GSM +358 400 648 180