The Hindu : National : Virus to target computers today

Online edition of India's National Newspaper
Friday, Mar 03, 2006

National

National

Virus to target computers today

Sandeep Dikshit

Comes in the form of an attachment

NEW DELHI: The Government-owned Indian Computer Emergency Response Team (CERT-In) has warned of a computer virus, which is activated every third day of a month. The virus is expected to attack computers on Friday and uses obscene subject lines, message content and attachments. The CERT-In has advised computer users to scan their systems by running removal tools mentioned on its website.

The virus, Nyxem attacks Microsoft Windows systems and is propagated in the form of an e-mail attachment. It also spreads through network shares. Upon activation, it replaces the content of user's files and reduces the size of all user data files to 1KB. The worm is also known as W32.Blackmal.E@mm, W32/Kapser.A@mm, W32/MyWife.d@MM, Win32/Blackmal.F, WORM_GREW.A (Trend Micro), Win32/Blackmal.F (Computer Associates) or Nyxem.e (F-secure).

When a user clicks on the attachment, the virus gets executed and performs the following actions: opens a .ZIP archive with the same name in the Windows system folder to hide its functionality, copies itself to the system folder with the filenames: scanregw.exe, Winzip.exe, Update.exe, movies.exe, Zipped Files.exe, also copies itself to the Windows folder with filenames: Rundll16.exe, WinZipTmp.exe, creates the registry entry to enable its automatic execution at every system start-up and hides files with both system and read-only attributes. It also deletes files related to anti-virus applications and attempts to spread to networks with weak passwords.

Printer friendly page
Send this article to Friends by E-Mail