Today's INFO
Countdown for nasty Windows virus
PC users have been urged to scan their computers before 3 February to avoid falling victim to a destructive virus.
>>> More Info @ Comments Below <<<
From: Rajarajan.G @ Mahindra British Telecom (Singapore)
Suriya Narayanan. R @ Bangalore
PC users have been urged to scan their computers before 3 February to avoid falling victim to a destructive virus.
>>> More Info @ Comments Below <<<
From: Rajarajan.G @ Mahindra British Telecom (Singapore)
Suriya Narayanan. R @ Bangalore
posted by 6 - F A C E at 11:33 PM
7 Comments:
Countdown for nasty Windows virus
Many file types from Microsoft Office are targeted by Nyxem
PC users have been urged to scan their computers before 3 February to avoid falling victim to a destructive virus.
On that date the Nyxem virus is set to delete Word, Powerpoint, Excel and Acrobat files on infected machines.
Nyxem is thought to have caught out those who open the attachments on e-mail messages carrying the virus.
Anti-virus companies have stopped lots of copies, suggesting it had infected a large number of computers.
The Nyxem-E Windows virus first emerged on 16 January and has been steadily racking up victims ever since. Nyxem-E is also known as the Blackmal, MyWife, Kama Sutra, Grew and CME-24 virus.
Helpfully, the virus reports every fresh infection back to an associated website which displays the total via a counter. Late last week the counter was reporting millions of infections, but detective work by security firm Lurhq found that many of these reports were bogus.
SAMPLE SUBJECT LINES
Fw: Funny :)
Fw: Picturs
*Hot Movie*
Fw: SeX.mpg
Re: Sex Video
Miss Lebanon 2006
School girl fantasies gone bad
However, Lurhq reported that more than 300,000 machines are known to have fallen victim to Nyxem-E.
Like many recent viruses, Nyxem tries to spread by making people open attachments on e-mail messages that are infected with the destructive code.
The subject lines and body text of the various messages Nyxem uses vary, but many falsely claim that pornographic videos and pictures are in the attachments.
On infected machines the virus raids address books to find e-mail addresses to send itself to.
The virus also tries to spread by searching for machines on the same local network as any computer it has compromised.
Unlike many recent viruses Nyxem is set to overwrite 11 different types of file on infected machines on the third of every month. The list of files to be over-written includes the most widely used sorts of formats.
NYXEM FILE TARGETS
DMP - Oracle files
DOC - Word document
MDB - Microsoft Access
MDE - Microsoft Access/Office
PDF - Adobe Acrobat
PPS - PowerPoint slideshow
PPT - PowerPoint
PSD - Photoshop
RAR - Compressed archive
XLS - Excel spreadsheet
ZIP - Compressed file
Separately, the virus also tries to disable anti-virus software to stop it updating and can also disable the mouse and keyboard on infected machines.
Users were being urged to update anti-virus software and to scan their system to ensure they had not been caught out. Many anti-virus firms have also produced tools that help clean up infected systems.
Jason Steer, technical consultant at mail filtering firm Ironport, said Nyxem was a throwback to the types of viruses that used to circulate in the early days of computer networks.
"If you go back 10-15 years ago viruses tended to quite malicious," he said. "They were going to re-format your hard disk, delete files and so on."
Pete Simpson, threat lab manager at security firm Clearswift, said: "It's a bit puzzling because script kiddies have largely left the scene.
"It shows a certain intelligence in its design but what's the motive?" he asked, "Pure vandalism does not ring true these days."
Both Mr Steer and Mr Simpson feared that home users would be hardest hit by Nyxem on 3 February.
Most businesses, they said, now have regularly updated anti-virus systems in place and disinfect e-mail traffic before it reaches users' desktops.
By contrast many home users did not regularly patch Windows, update anti-virus or perform full system scans to ensure their machine stays clean. Users were also encouraged to make regular back-ups of any files they want to preserve.
http://news.bbc.co.uk/1/hi/technology/4661582.stm
Big problem with a really intelligent worm virus in Yahoo groups
Take note of this!!!!
Presently people are having a big problem with a really intelligent worm virus in Yahoo groups.This virus usually reaches a mail box some way and then tracks the ids with the word "group"and send mails with subject lines usually of a forward which is already present in you mail box.
This virus is intellegent is becausee of two reasons
- It sends mails with virus to groups by searching for the word "group" in its address book or inbox id's
- It takes the subject line of any mail with "FW:"in it and sends it across to the groups and the sent mail is not even seen in the sent items box.
Suggestions [generic for any virus infected mail box]
1) Create 2 mail ids in address book one with name: !0000 ( so that it wil be the 1st contact, and should not enter any email address for that) and another with ID: aaa@aaa.com this creates confusion to any normal virus in the first try of its sending the mail itself!
2) Create another id in address book with id: aaaaabcdnothing@yahoogroups.com this will prevent the new virus from spreading to other groups coz when it tries this id it restarts trying and will end up in retrying for this id countless number of times thus preventing from spreading to some other mail box or groups.
This is a simple way of preventing viruses from spreading to other mail boxes
Thanks a Lot for taking time to read this.
Avoid spreading of Virus and Worms!!
W32.Blackmal.E Remover (Symantec)
DOWNLOAD
>>> http://securityresponse.symantec.com/avcenter/FixBmalE.exe
On February 3 the virus will be activated to destroy a wide range of files including Word, Powerpoint, Excel and Acrobat on infected machines.
If it is not removed, it will attack again on the third day of each month going forward, according to a Microsoft blog.
Tomorrow is D-Day for a dangerous computer virus which has spread throughout the world via email and is programmed to destroy PC files on February 3.
Email messages with risque subjects like "give me a kiss" and "school girl fantasies" have helped to spread the virus across about 300,000 computers worldwide according to a taskforce set up to monitor the threat.
The virus is known under several different names including Blackworm, Nyxem, CME-24, Blackmal, Kama Sutra and MyWife.
The Blackworm taskforce, which comprises a large number of security organisations, warns that although those with recently updated anti-virus and anti-spyware should be protected from attacks, the virus was built to disable a number of security packages. This means that those PCs that were already infected before the most recent anti-virus signatures were downloaded could still be vulnerable.
Once a PC is infected, the virus will replicate and send itself to all of the user's email contacts and will then lie dormant until February 3. On this date it will begin destroying a wide range of files including Word, Powerpoint, Excel and Acrobat on infected machines. If it is not removed, it will attack again on the third day of each month going forward.
According to computer emergency response team AusCERT, the virus has attracted so much attention because it is the first to carry such a destructive payload for quite some time.
"Recent movement has been away from purely destructive worms towards for-profit viruses like keystroke loggers for and bot net clients," said security analyst, Chris Horsley.
AusCERT has been tracking its frequency in Australia and said that based on worldwide infection figures, it estimated that about 1000 PCs in Australia would be affected.
"The worst affected regions are India, Peru and the US," it said.
AusCERT recommends applying strong passwords to all user accounts, updated anti-virus and anti-spyware protection, and the use of a firewall.
Another way of avoiding the virus is to operate a PC under a limited account rather than administrator account because this means the malware doesn't have access to the privileges needed to spread and execute, AusCERT said.
Thank you for providing the link for downloading virus removal patch.
Post a Comment
<< Home