Reflections of a Survivor

Over the last week, “Blackworm” infected about 300,000 systems. It is so far known as Blackmal, Nyxem, MyWife, Tearec among other names. This worm is different and more serious than other worms for a number of reasons. In particular, it will overwrite a user’s files on February 3^rd and then the 3^rd day of every month.

At this point, the worm will be detected by up-to-date antivirus signatures. To protect yourself from data loss on February 3^rd, you should use current (Jan 23^rd or later) antivirus signatures. Note, however, that this malware attempts to disable/remove any antivirus software on the system (and does this every hour while the system is up), so if the machine was infected before signatures were deployed, obviously, that antivirus software can’t be expected to clean up the infection for you.

The worm spreads via e-mail attachments or file shares. Once a system in your network is infected, it will try to infect all shared file systems it has access to. You may see a new “zip file” icon on your desktop. It will disable most antivirus products and delete them. The worm will e-mail itself using various extensions and file names. It will add itself to the list of auto-start programs in your registry.

For more and up-to-date information on the virus, please visit Internet Storm Center.

Please tell as many people as you could about this virus, so their computers does not get infected by this virus…