Internet Worm Aliases: MyWife; Blackmal; Nyxem; Tearec; Kapser; Worm_Grew
Description of the Threat:
There is an Internet worm scheduled to activate on the 3rd day of each month. February 3rd is this Friday and OIT wanted to make you were aware of possible issues associated with it. While this worm is classified as “Low Risk” by McAfee it is of a particularly nasty nature. Specifically it is designed to overwrite many common Microsoft Windows file types on your workstation rendering them permanently unusable. Macs are unaffected by this worm.
OIT Actions:
OIT has rules in place on our Intrusion Prevention System (IPS), also known as the Tipping Point, that will block this worm within the UMBC campus. In addition all machines that are joined to our centrally managed Active Directory should have McAfee AntiVirus installed. If a machine is running McAfee and has DAT file 4642 or higher then McAfee should detect and clean the infection prior to any file loss. McAfee will detect this worm as “MyWife”.
Home Users:
Customers should check the following:
• AntiVirus Software is installed and has been updated (UMBC’s version of McAfee automatically updates the DAT file) Click Here to Download McAfee
• Backup any important files to CD, DVD or a USB Key. It is important that this backup not be located on the computer as the worm can detect these files too.
• Turn on Windows Automatic Updates Click Here for Information about Automatic Updates
Method of Infection:
This is a mass mailing worm that infects machines via an e-mail message. The message will contain an attachment with a *.PIF, *.JPG or *.ZIP file. Execution of these files will infect an unprotected machine. Please visit http://vil.nai.com/vil/content/v_138027.htm for full details.
Impact:Below are the file types that it will render unusable. These files will not be able to be recovered once overwritten.
• DOC
• XLS
• MDB
• MDE
• PPT
• PPS
• ZIP
• RAR
• PDF
• PSD
• DMP