Trend Micro Threat Advisory: WORM_GREW.A (AKA: Nyxem and Blackworm)

A new malicious worm began infecting systems last week, which promises to launch an attack on February 3rd – and the 3rd of every month thereafter, according to threat researchers at antivirus and content security firm Trend Micro. The new worm, known by such names as Nyxem, BlackMal, Mywife, and CME-24, has infected hundreds of thousands of machines over the past week, most from unsuspecting users who do not yet know they are infected.

Like most worms, WORM_GREW.A propagates via email attachments and network shares, including popular P2P file sharing services. The email method of transmission employs common social engineering techniques – including the promise of pictures, pornographic content, or a joke – to entice users to open the corresponding attachment.

According to Jamz Yaneza, Senior Threat Analyst at Trend Micro, though this worm utilizes common propagation techniques, the code itself is anything but common. “This is a destructive virus that deletes and overwrites any number of files present on a user’s system, by targeting the most popular file formats – including .DOC, .XLS, .PPT, .PDF, and .ZIP, to name just a few” says Yaneza. “In addition to losing a great deal of data, this virus also renders the keyboard and mouse inoperable, thereby leaving the user’s system dead in the water.” Yaneza adds that this is a truly global threat, affecting computer systems in over 150 countries, to date.

There is good news, though. Since this threat is relatively well-known to the security industry, most major security vendors – including Trend Micro – detect this worm and its variants.

Trend Micro has specific detection for all currently-known variants of this worm, and successfully detects all new variants generically, thereby providing broad protection against this threat. Additionally, Trend Micro has the capability to automatically remove this worm, via its Damage Cleanup Services. Trend Micro customers can visit:
http://uk.trendmicro-europe.com/enterprise/support/tsc.php to utilize this service.

Security Guidance:

“The best defense is for users to run a scan of their systems, to ensure they haven’t been infected” says Jeffrey Aboud, Trend Micro’s Threat Response Manager. “The attack is hard-coded in the Worm, so if they haven’t been infected, then there’s no need to worry about the February 3rd attack, as long as they stay clean.” Aboud adds the following advice for users:

• Do not open any emails from those you don’t know

• Do not open attachments from those you do know, if you weren’t expecting an attachment from that person, or if the content of the email seems out of character for that person

• Ensure your antivirus definitions are up-to-date. Trend Micro customers should be using OPR 3.180.03 or later

• Run a manual scan with your updated Trend Micro product, or with Housecall, Trend Micro’s free online virus scanner. Housecall is available at:
http://uk.trendmicro-europe.com/consumer/housecall/housecall_launch.php

For More Information:

For additional or updated information on this threat, see Trend Micro’s Virus Encyclopedia, at:
http://uk.trendmicro-europe.com/consumer/vinfo/encyclopedia.php?LYstr=VMAINDATA&vNav=1&VName=WORM_GREW.A&highlight=worm_grew.a



About Trend Micro
Trend Micro, Inc. is a leader in network antivirus and Internet content security software and services. The Tokyo-based corporation has business units worldwide. Trend Micro products are sold through corporate and value-added resellers. For additional information and evaluation copies of all Trend Micro products, visit our Web site at http://www.trendmicro.com.

Trend Micro (UK) Ltd
Pacific House
Third Avenue
Globe Business Park
Marlow
Buckinghamshire
SL7 1YL

- Contact:
Elizabeth Blanch
Trend Micro
Tel.: +44 (0) 1628 400513
Fax: +44 (0) 1628 400511
Email: elizabeth_blanch@trendmicro.co.uk

This release was published on openPR.