Blackworm

{{Short description|Computer worm}}

{{For|the animal|Lumbriculus variegatus}}

Blackworm is an Internet worm discovered on January 20, 2006 that infects several versions of Microsoft Windows. It is also known as Grew.a, Grew.b, Blackmal.e, Nyxem.e, Nyxem.d, Mywife.d, Tearec.a, CME-24, and Kama Sutra.

Blackworm spreads mainly by sending infected email attachments, but also infects other computers by copying itself over network shares. The virus removes antivirus programs from remote computers before attempting to infect them. When first installed, it copies itself to the Windows and system directories. It uses filenames that resemble those of legitimate Windows system files in an attempt to remain hidden. It activates on the third day of each month; the first known activation happened on February 3, 2006.[http://isc.sans.org/diary.php?storyid=1067 Description of Blackworm from the Internet Storm Center][http://www.secureworks.com/research/threats/blackworm/ LURHQ Threat Intelligence Group] BlackWorm Hostile Payload Scheduled to Activate Feb 3 On activation, the virus overwrites data files of many common types, including Word, Excel, and PowerPoint documents; ZIP and RAR archives; and PDFs. It can destroy files on fixed and removable drives and tries, but fails, to affect data on network drives. It also attempts to disable antivirus programs by removing the registry entries that automatically run them and deleting the antivirus programs directly.

The virus visits a tracking Web page each time it infects a computer. Over 300,000 unique IPs visited that site,[http://www.f-secure.com/v-descs/nyxem_e.shtml Description of Blackworm from F-Secure] suggesting that at least that many computers suffered infection. It is not known how many of them remained infected long enough to trigger the virus’s payload.