The Mudcat Café TM
Thread #88359   Message #1656433
Posted By: JohnInKansas
27-Jan-06 - 09:46 AM
Thread Name: Tech: Urgent Worm Warning
Subject: Tech: Urgent Worm Warning
Urgent Alert Raised for 'Blackworm' D-Day eWeek. By Ryan Naraine, January 24, 2006

It is "unusual" for the AV people to put out an "urgent" alert of this kind. It's uncertain just how much damage may occur, but the potential is rather high.

The "Blackworm," a.k.a. "Kama Sutra," "Blackmal," "MyWife," and "Nyxem," is quite new and is claimed to have infected at least 700,000 individual machines as of 5 PM January 24. "F-Secure said the worm accounts for more than 17 percent of all virus infections in the last 24 hours."

The payload for this particular infection is really nasty, since it is set to "go off" on the third day of each month and delete ALL Microsoft Word, Microsoft Excel, PowerPoint, PDF, ZIP and PSD files on all available drives. The deletion is complete. It DOES NOT send the files to the trash bin where they might be restored. The files are obliterated.

Since February 3 is a "trigger date," when the worm will do its damage on infected machines, a download of CURRENT AV DEFINITIONS and a FULL SYSTEM SCAN for virus infection is strongly recommended before that date.

The worm also attempts to block/destroy AntiVirus programs, so if your AV fails to run as expected there's a very good chance you've been infected with this or with one of a few similar ones.

The report is that people with good AV programs on their individual machines, current definitions, and regular scans probably will not be infected. An original infection is from an email (reportedly with explicit "Kama Sutra" photos), but since the worm propagates itself once established on a machine, it can spread on networks (including sneaker nets) without involving email.

If you're working on something critical that involves one of the file types listed, and if you're unsure of your protections, copying critical files to CD or DVD, or some other removable media, or to an external Hard drive that you can unplug until after the Feb 3 "event," when you're sure you're safe, might be worth considering.

If you don't have a good AV with current definitions to scan your machine, most of the AV makers can do an "online scan" that will probably suffice. If the worm has been triggered and has disabled your AV, that would be a first step to getting the infection cleaned up.

Since most 'catters do keep their AV up to date, I'd expect this to be pretty much a non-event; but the AV people are treating it as something potentially very serious.

Anything much that you can do about this is stuff you should be doing anyway so panic is probably not merited. If you haven't been doing the regular stuff, then run in circles, scream and shout…

John