Nyxem.E virus delete files payload



F-secure has some details on a dangerous payload for the Nyxem.E virus. (The Nyxem.E virus is very similar to the Email-Worm.Win32.VB.bi that was talked about earlier in the week.) In fact, this virus seems to be spreading fairly well (not the blockbuster spread of older email viruses, but it is spreading.) Anyway, according to f-secure it will on the 3rd of the month, delete all files matching the following patterns. *.doc *.xls *.mdb *.mde *.ppt *.pps *.zip *.rar *.pdf *.psd *.dmp *(on all accessible drives.)


What this means is that IF you have this virus and it’s the third of the month it will delete most all Microsoft Office formatted documents + rar’s, zips, pdf and a few other file formats. Nasty. Technically it doesn’t delete them, but overwrite their data with… “The files’ contens get replaced with a text string “DATA Error [47 0F 94 93 F4 K5]“.”

Through the process of infection it also deletes the following files…..

DAP*.dll
BearShare*.dll
SymantecLiveUpdate*.*
SymantecCommon FilesSymantec Shared*.*
Norton AntiVirus*.exe
Alwil SoftwareAvast4*.exe
McAfee.comVSO*.exe
McAfee.comAgent*.*
McAfee.comshared*.*
Trend MicroPC-cillin 2002*.exe
Trend MicroPC-cillin 2003*.exe
Trend MicroInternet Security*.exe
NavNT*.exe
Kaspersky LabKaspersky Anti-Virus Personal*.ppl
Kaspersky LabKaspersky Anti-Virus Personal*.exe
GrisoftAVG7*.dll
TREND MICROOfficeScan*.dll
Trend MicroOfficeScan Client*.exe
LimeWireLimeWire 4.2.6LimeWire.jar
Morpheus*.dll

( The * matches anything for those that don’t know…., so deleting *.dll in a folder deletes this.dll that.dll and the other.dll, without having to explicitly give a delete command for each. Think of it as “delete everything that ends with .dll” to delete *.dll)

Related Posts

Blog Traffic Exchange Related Posts
  • How to Remove Antivir | Antivir Removal Guide Antivir is a rogue antivirus application that is pushed through web site popup ads on unsuspecting users. Basically in web browsing you may see a popup claiming that your computer is infected and you should run a malware scan. Clicking to proceed will probably show an animation of a scan......
  • Hiding malware may evade antivirus Sans had an interesting malware analysis this morning about a blob that appeared to be ascii text (gibberish) that was retrieved by a piece of malware. It turns out that the ascii text was a cleverly encoded exe file (windows executable or program file.) It took several iterations of their......
  • How to Remove Personal Security | Personal Security Removal Guide Personal Security is a rogue antivirus application that comes from the same (dreaded) family as the Cyber Security rogue. It usually installs on the users computer without the permission of the computer user. Once installed on the system it will then perform supposed scans finding lots of virus infected files......
Blog Traffic Exchange Related Websites
  • Installing a WordPress Blog If you want to install WordPress on your own server, the first step is to download the necessary files from the website at WordPress.org download. Next, you will use an FTP program to upload the files to your host site. If you use Cpanel, you can use Fantastico in order......
  • Threat Outbreak Alert: Fake Bin Laden Pictures E-mail Messages on May 13, 2011 Source: Security Intelligence Operations Cisco Security Intelligence Operations has detected significant activity related to Portuguese-language spam e-mail messages that claim to contain  pictures of Osama Bin Laden  The text in the e-mail message instructs the recipient to open a .zip attachment to view the pictures.  However, the .zip attachment contains a......
  • Micro-Trend Trading for Daily Income: Using Intra-Day Trading Tactics to Harness the Power of Today's Volatile Markets Reviews Micro-Trend Trading for Daily Income: Using Intra-Day Trading Tactics to Harness the Power of Today's Volatile Markets ISBN13: 9780071752879Condition: NewNotes: BRAND NEW FROM PUBLISHER! BUY WITH CONFIDENCE, Over one million books sold! 98% Positive feedback. Compare our books, prices and service to the competition. 100% Satisfaction Guaranteed Profit every day......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site