Click to Save up to $300/yr on calls
- Related Stories
-
Kama Sutra worm seduces PC users
January 23, 2006 -
All quiet on the Sober front
January 6, 2006
The virus, dubbed Nyxem.E among other names, was first reported on Jan. 16. It is thought to have infected more than half a million PCs. Security vendor IronPort warned Thursday that these machines are now hard-coded to propagate the virus on Feb. 3.
Companies are unlikely to be directly affected if they are running up-to-date antivirus software, because the major antivirus vendors have now released patches. But IronPort warned that companies could experience secondary effects, as the virus tries to propagate itself by harvesting e-mail addresses on an infected machine.
"The knock-on effects will come as compromised PCs try to communicate with businesses. This will cause additional e-mail and network traffic and a possible slowdown in e-mail response time," said Jason Steer, a technical consultant at IronPort.
F-Secure has reported that Nyxem.E reached the top position on Thursday in its virus statistics list, with 21.7 percent of all reported infections. The worm has infected some 300,000 systems, according to a Lurhq analysis of logs from a Web site statistic counter that the worm uses to keep track of its spread.
Once active, Nyxem will try to delete all Word, Excel, PowerPoint and PDF file types from a compromised PC. The multifaceted malicious software will also attempt to propagate itself, both through e-mail and as a network worm, which can be particularly damaging on closed networks.
"Nyxem is certainly malicious. It can be delivered via e-mail, but also as a network worm. It probes other PCs on a closed network to compromise them and send itself to the other computers, to infect as many hosts as possible," Steer said.
The malicious software hides in attachment types not typically blocked by attachment filters, IronPort said.
The Internet community will not know the scale of the February attack until it occurs. "It depends on how many hosts are infected," Steer said. "At the moment it's just sitting there quietly, and we won't know how many home users have been infected until Feb. 3."
Businesses should warn their employees not to open suspicious e-mails, and to know what these e-mails may look like. "The subject lines may contain some references to pornography--fairly typical stuff," Steer said.
"Be vigilant. Update your antivirus patches and make sure your hard disk has been scanned to detect and remove the virus," he added.
Nyxem has the potential to cause havoc throughout the year, as infected PCs are set to activate on the third day of every month, unless they are cleaned up.
Tom Espiner of ZDNet UK reported from London.
See more CNET content tagged:
Nyxem,
Ironport Systems Inc.,
Kama Sutra worm,
virus,
malicious software
This reminds me of the thousands who spread around the Paris Hilton screensaver last month, or those that got a virus when they visited one of Cristina Aguilera's fan sites. There always seems to be enough fools to spread these things around.
Experts or the unsavy home users targeted?
I've never even heard of the group called GOONS, until you brought it up. My Correction(Typo) post is exactly that---a correction to a typo. In the title line, I accidentally typed Kame instead of Kama. It's that simple. I think you may have been confused because I capitalized the word Typo. I usually capitalize the words in the title lines to my posts---like the title words of books are capitalized.