Nyxem email worm offers trouble in store Helsinki, Finland - February 1, 2006 In late January, an email worm called Nyxem.E started spreading in computers around the globe but its main payload is yet to drop. Nyxem is also known as Blackworm, Kama Sutra or Mywife. The Common Malware Enumeration (CME) reference for it is CME-24. For those computers infected by Nyxem.E, next Friday and every third day of the month will see the worm replacing the content of a broad range of user's files with a text string "DATA Error [47 0F 94 93 F4 K5]". Among these files are: DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP. The destructive deadline of the Nyxem.E worm is, however, based on the clock of the infected machine meaning that the worm has already claimed its first victims. Speaking about the Nyxem worm and the initiative to combat it, Chief Research Officer, Mikko Hypponen said: “There are as many as 300,000 computers that are infected – largely in Turkey, Peru and India but also in other countries around the world. They will feel the full force of Nyxem in near time if they don’t take action.” Hypponen continued that Nyxem’s capacity to seed destruction in computers without any clear motive or commercial gain was unusual in modern malware but demonstrated that black hats still displayed a wanton desire to cause havoc as they did in earlier years. F-Secure has shipped a free tool to disinfect machines hit by Nyxem. It is available from http://www.f-secure.com/v-descs/nyxem_e.shtml About F-Secure Corporation F-Secure Corporation protects consumers and businesses against computer viruses and other threats from the Internet and mobile networks. We want to be the most reliable provider of security services in the market. One way to demonstrate this is the speed of our response. According to independent studies in 2004 and 2005 our response time to new threats is significantly faster than our major competitors. Our award-winning solutions are available for workstations, gateways, servers and mobile phones. They include antivirus and desktop firewall with intrusion prevention, antispam and antispyware solutions, as well as network control solutions for Internet Service Providers. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since 1999, and has been consistently growing faster than all its publicly listed competitors. F-Secure headquarters are in Helsinki, Finland, and we have regional offices around the world. F-Secure protection is also available as a service through major ISPs, such as France Telecom, TeliaSonera, PCCW and Charter Communications. F-Secure is the global market leader in mobile phone protection provided through mobile operators, such as T-Mobile and Swisscom and mobile handset manufacturers such as Nokia. The latest real-time virus threat scenario news are available at the F-Secure Data Security Lab weblog at http://www.f-secure.com/weblog/ For further information, please contact: F-Secure Corporation Mikko Hypponen, Chief Research Officer PL 24 FIN-00181 Helsinki GSM +358 400 648 180