Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: InfoSec Handlers Diary Blog - More on Blackmal/Grew/Nyxem (file deletion payload) InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

More on Blackmal/Grew/Nyxem (file deletion payload)

Published: 2006-01-20
Last Updated: 2006-01-21 05:06:05 UTC
by Jim Clausing (Version: 1)
0 comment(s)
Following up on Bojan's story from Wednesday, F-Secure posted a bulletin today with their analysis of the current variant.  The interesting (or is it scary?) part of this analysis is the revelation that on the 3rd of the month it will attempt to delete a lot of documents off the user's disks, including Office documents (*.doc, *.xls, *.ppt, *.pps), PDF files, .zip and .rar archives among others.  They also report that based on a counter on a web page that the worm updates, there are in excess of 400,000 machines infected at this time.

Jim Clausing, jclausing /at/
0 comment(s)
Diary Archives