Threat Level: green Handler on Duty: Chris Mohan

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

More on Blackmal/Grew/Nyxem (file deletion payload)

Published: 2006-01-20
Last Updated: 2006-01-21 05:06:05 UTC
by Jim Clausing (Version: 1)
0 comment(s)
Following up on Bojan's story from Wednesday, F-Secure posted a bulletin today with their analysis of the current variant.  The interesting (or is it scary?) part of this analysis is the revelation that on the 3rd of the month it will attempt to delete a lot of documents off the user's disks, including Office documents (*.doc, *.xls, *.ppt, *.pps), PDF files, .zip and .rar archives among others.  They also report that based on a counter on a web page that the worm updates, there are in excess of 400,000 machines infected at this time.

-----------------
Jim Clausing, jclausing /at/ isc.sans.org
Keywords:
0 comment(s)
Diary Archives