# MA-102.022006: MyCERT Advisory - W32.Nyxem.E Worm

**Date:** 03 Feb 2006  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-102.022006  
**Advisory ID:** MA-102.022006

---

#### Introduction
MyCERT received information from various reliable sources regarding the circulation of a particular worm and its variant, known as the W32.Nyxem.E worm, also known as the BlackWorm. W32.Nyxem.E is a mass-mailing worm that attempts to spread through network shares and lower security settings. Most anti-virus vendors had rated the W32.Nyxem.E worm as MEDIUM in risk assessment and MEDIUM in potential damage associated to the worm. The worm's destructive payload activates on every third day of the month by replacing the content of user's files with a text string "DATA Error [47 0F 94 93 F4 K5]", 30 minutes after the PC has been turned on. Among these files are: DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP.
Based on number of reports received as of the alert was written, currently no strong evidence indicating widespread infection relating to W32.Nyxem.E worm and its variants in our constituency, but MyCERT advises users and organizations to ensure their anti-virus is always updated with the latest signature file and take the prevention actions as provided below to prevent against the worm infection and future incidents that may target any particular vulnerability. The main difference between this worm and its previous variant is it has the trigger date on every 3rd day of every month where the worm will destroy data saved on the victim machine.
### System Affected
- Windows 2000
- Windows 95
- Windows 98
- Windows Me
- Windows NT
- Windows Server 2003
- Windows XP
### Payload
1. The worm's destructive payload activates on every third day of the month by replacing the content of user's files with a text string "DATA Error [47 0F 94 93 F4 K5]". Among these files are: DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP.
2. Turns off anti-virus applications and other security 
3. Sends itself to email addresses found on the infected computer.
4. Forges the sender's email address.
5. Uses its own emailing engine.
6. Downloads code from the internet.
7. Reduces system security.
8. Installs itself in the Registry.
### Subject of Email
Attempts to send itself as an email to the addresses it gathers using its own SMTP engine. The email will have the following characteristics:
One of the following:
- \*Hot Movie\*
- A Great Video
- Fw:
- Fw: DSC-00465.jpg
- Fw: Funny :)
- Fw: Picturs
- Fw: Real show
- Fw: SeX.mpg
- Fw: Sexy
- Fwd: Crazy illegal Sex!
- Fwd: image.jpg
- Fwd: Photo
- give me a kiss
- Miss Lebanon 2006
- My photos
- Part 1 of 6 Video clipe
- Photos
- Re:
- School girl fantasies gone bad
### Message Body
One of the following:
- Note: forwarded message attached. You Must View This Videoclip!
- >> forwarded message
- Re: Sex Video
- i just any one see my photos.
- It's Free :)
- The Best Videoclip Ever
- Hot XXX Yahoo Groups
- Fuckin Kama Sutra pics
- ready to be FUCKED ;)
- forwarded message attached.
- VIDEOS! FREE! (US$ 0,00)
- What?
- i send the file.
- Helloi attached the details.
- Thank you
- the file i send the details
- hello,
- Please see the file.
- how are you?
- i send the details.
### Message Body
One of the following:
- 007.pif
- 392315089702606E-02,.scR
- 677.pif
- Adults\_9,zip.sCR
- Arab sex DSC-00465.jpg
- ATT01.zip.sCR
- Attachments[001],B64.sCr
- Clipe,zip.sCr
- document.pif
- DSC-00465.Pif
- DSC-00465.pIf
- eBook.pdf
- eBook.PIF
- image04.pif
- New Video,zip
- New\_Document\_file.pif
- photo.pif
- Photos,zip.sCR
- School.pif
- SeX,zip.scR
- Sex.mim
- Video\_part.mim
- WinZip,zip.scR
- WinZip.BHX
- WinZip.zip.sCR
- Word XP.zip.sCR
- Word.zip.sCR
- 04.pif
- DSC-00465.Pif
- DSC-00465.pIf
- image04.pif
The attachment may be an executable file or a MIME file that contains an executable file. Those attachments that are MIME files may have the following file names:
- 3.92315089702606E02.UUE
- Attachments[001].B64
- Attachments00.HQX
- Attachments001.BHX
- eBook.Uu
- Original Message.B64
- Sex.mim
- SeX.mim
- Video\_part.mim
- WinZip.BHX
- Word\_Document.hqx
- Word\_Document.uu
These files may also have one the following file names:
- 392315089702606E-02
- Clipe
- Miss
- Photos
- Sweet\_09
These file names will be combined with one of the following extensions:
- .b64
- .BHx
- .HQX
- .mim
- .uu
- .UUE
- .XxE
If the attachment is a MIME file, it may contain a file with one of the following file names:
- 392315089702606E-02,UUE[BLANK SPACES].scr
- Adults\_9,zip[BLANK SPACES].scr
- ATT01.zip[BLANK SPACES].scr
- Atta[001],zip[BLANK SPACES].scr
- Attachments,zip[BLANK SPACES].scr
- Attachments[001],B64[BLANK SPACES].scr
- Clipe,zip[BLANK SPACES].scr
- New Video,zip[BLANK SPACES].scr
- Photos,zip[BLANK SPACES].scr
- SeX,zip[BLANK SPACES].scr
- WinZip,zip[BLANK SPACES].scr
- WinZip.zip[BLANK SPACES].scr
- Word XP.zip[BLANK SPACES].scr
- Word.zip[BLANK SPACES].scr
The attachment may use the following icon:
How to Tell if your Computer is Infected
1. Presence of the worm 
2. Dysfunction of your computer's anti-virus applications and other security 
3. Some of your files may had been deleted or overwritten with a text string "DATA Error [47 0F 94 93 F4 K5]", unknowingly.
4. Additional values in your Registry.
5. The presence of a new "zip file" icon on your desktop.
### Detection
Scan the infected computer with an updated Anti-virus softwares to detect the presence of the worm on infected machine.
NOTE: Users MUST update their Anti-virus softwares in order to detect/delete the worm.
### Removal Steps
#### Automatic Removal
( Users are recommended the Automatic Removal as it is the easiest way to clean up an infected machine)
1. Disconnect the machine from the network.
2. Disable system restore for Windows XP/ME.
3. Update your Anti-virus software with latest signature file.
4. Patch your machine with appropriate latest patches.
5. Use an Automatic Removal Tool to cleanup the infected machine.
Automatic Removal Tools:
Symantec
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
F-Secure:
http://www.f-secure.com/tools/f-force.zip
6. Reinstall and update your anti-virus softwares and other security 
7. Re-scan the machine to confirm if it is clean.
8. Enable the System Restore (for Windows ME/XP only).
9. Re-connect the machine to the network.
#### Manual Removal
1. Disconnect your machine from the network.
2. Disable System Restore(Windows XP/Windows Me only).
Windows XP:
1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Select "Turn off System Restore" or "Turn off System Restore on all drives" check box.
Windows Me:
1. Click Start, point to Settings, and then click Control Panel.
2. Double-click the System icon. The System Properties dialog box appears.
3. Click the Performance tab, and then click File System. The File System Properties dialog box appears.
4. Click the Troubleshooting tab, and then check Disable System Restore.
5. Click OK. Click Yes, when you are prompted to restart Windows.
3. Start your machine in Safe mode.
4. Terminate the malicious code activities that are running in the machine.
In Task Manager, terminate any process with one of the following names to stop it running in the memory:
- rundll16.exe
- scanregw.exe
- Update.exe
- Winzip.exe
- WINZIP\_TMP.EXE
- New WinZip File.exe
- WinZip Quick Pick.exe
5. Search for file stated above and delete it.
1. Click ‘Start'. Go to ‘Find' .Type ‘'.
2. Delete the file.
3. Go to Recycle Bin. Delete and empty the Recycle Bin.
6. Delete the dropped file by the worm at registry.
1. Click Start, and then click Run. (The Run dialog box appears.)
2. Type regedit. Then click OK. (The Registry Editor opens.)
3. Navigate to the key and delete added value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"ScanRegistry" = "scanregw.exe /scan"
4. Exit the Registry Editor.
7. Enable the System Restore (for Windows XP/Windows Me)
### Prevention
1. Install the latest computer updates/patches.
2. Enable and use up-to-date antivirus software.
3. Close all ports except your http port otherwise you need to filter the ports to authorized users only.
4. Enable a personal firewall on your computer.
5. Practise safe computing/safe email practices.
6. System Administrators may consider to filter executable and unknown file types at the email gateway which is enough to prevent the worm from entering a network. The attachments sent by the worm may contain the following extensions:
pif, scr, mim,uue, hqx, bhx, b64, and uu.
NOTE: System Administrators may consider to disable their anti-virus softwares from sending out notification messages to receipients, temporarily, to prevent clogging of end users' mailbox.
If you believe that your computer has been infected in any way, we encourage you to report to MyCERT at:
Tel: 03-89961901
Fax: 03-89960827
Email: [[email protected]](/cdn-cgi/l/email-protection)
Web: [https://www.mycert.org.my/report\_incidents/online\_form.html](/report_incidents/online_form.html)
SMS: 019-2813801