Wednesday, November 25, 2020
  • Home
  •             

Nyxem: nothing happened?

February 6th, 2006 by Patrick S

So, Nyxem.E had infected hundreds of thousands of computers over the last two weeks. It activated on Friday, overwriting data. But almost nobody reported any problems. So what happened?

data.xlsWell, probably several things, including:

– The amount of machines that were really infected still on Friday was much smaller than the total amount of machines that got infected (and cleaned) during the whole outbreak. This number is probably in the tens of thousands. Which is not a lot of computers out of, say, one billion computers in the world.

– Many of the infected machines were not rebooted on Friday. They were simply running all the time. The worm only does damage when you start the machine on the 3rd.

– Many infected home machines were shut down all of Friday, and nothing happened. People went to movies, bars, parties on Friday night instead of surfing.

– The media coverage on the whole incident prompted many people to check their system and clean them up in time.

So, does this mean there weren’t any problems reported, anywhere? Well, no. We had some isolated support calls to our country offices from home users who were hit. And a partner company of ours in USA was contacted with a company that had one of their Windows servers hit.

And there were some unconfirmed online reports of problems. You can find examples if you dig online forums and usenet groups. See some examples below:

Newsgroups: microsoft.public.excel.misc
From: “=?Utf-8?B?bXVydWdhbl9oc0B5YWhvby5jb20=?=”
Subject: data error while opening files
Date: Wed, 18 Jan 2006 22:18:02 -0800

when i open excel or word existing file i getting contents as “DATAError
[47 0F 94 93 F4 K5]” instead of my saved data.
pls help me solving. My all word & excel files are have same problem.

Newsgroups: microsoft.public.excel.misc
From: “saran”
Subject: Re: data error while opening files
Date: 2 Feb 2006 23:18:19 -0800

i am also having the same problem i thing the virus webmal can corrupt
the dat if u got the solution pls send it to me
 

Newsgroups: Yummypinays
From: Elpidio Garcia
Date: Fri, 3 Feb 2006 05:03:39 +0000 (GMT)
Subject: [YP] HHHHHHHHHHHHelp!!!!!!! anyone…

…i found out that all my files particularly office docs were corrupted
and only shows this message everytime i open my files,
DATA Error [47 0F 94 93 F4 K5]
 

Source: F-Secure

Posted in Security | 7 Comments »


This entry was posted on Monday, February 6th, 2006 at 12:11 am and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.


7 Responses

  1. Naseem Says:

    when i open excel or word existing file i getting contents as “DATAError
    [47 0F 94 93 F4 K5]” instead of my saved data.
    pls help me solving. My all word & excel files are have same problem.

  2. Naseem Says:

    i need help when i open excel or word existing file i getting contents as “DATAError
    [47 0F 94 93 F4 K5]” instead of my saved data.
    pls help me solving. My all word & excel files are have same problem.

  3. Patrick S Says:

    Hi there…It seems that you have indeed been infected with Nyxem I will search for a fix

  4. Patrick S Says:

    hey again, Try this site
    http://www.symantec.com/avcenter/venc/data/w32.blackmal.e@mm.html

    and hit the “to fix this problem get the removal tool button” hopefully that will remove it…but i am not sure if it will recover your xls workbooks.

    Patrick

  5. glen t Says:

    hve tried to use the fixtools, but the affected files is not recovered. any solutions on how to recover affected files?

  6. Patrick S Says:

    So did the fix tools find the error?
    I dont know if you can recover the errors

  7. a jabbar Says:

    i got infected my system