BlackWorm (MyWife.d)

ZoneAlarm® Antivirus will protect you against the BlackWorm (MyWife.d) scheduled to attack on Feb. 3, 2006

Severity: High Risk

BlackWorm is a new and potentially destructive Internet worm currently making its way around the globe. It is infecting users via e-mail and is scheduled to destroy all Microsoft Word, Excel, PowerPoint, PDF, PSD and ZIP files on Feb. 3.

If you upgrade to ZoneAlarm Antivirus before Feb. 3, it will detect and remove existing BlackWorm infections and prevent future infections.

got this in my email today
anybody know much about this badboy ?

It is known as Blackworm/Kama Sutra, and is classed as an "Old-School" type virus, which is created to destroy data.

Check this out: http://www.theregister.co.uk/2006/02...y_virus_chart/


Liam

I know one thing. This baby is gonna make me a whole bunch of money. ;) :D

Ditto what usil says. :D :D

Of possible interest
http://www.microsoft.com/security/en...32/Mywife.E@mm
Near the end MS offers two scanners.

A fix here;

http://www.bitdefender.com/[email protected]

Does anyone know if there is a way to fix the files ruined by this virus?

usil--I think the scanners in my post #5 above are supposed to do that. See the "How to Recover from Infection" section near the end.

Welshjim, I don't think those scanners can fixed files such a doc xls ppt etc. Those are the kind of files I am talking about. The scanners probably just get rid of the virus itself.

AFAIK, the virus will destroy the files, so make sure your defences are up, and if it breaches them, start looking for some freeware file recovery apps.


Liam

usil--you may be right. MS makes no claim to repair files, only to spot and get rid of the worm. MS also issued this KB article.
http://www.microsoft.com/technet/sec...ry/904420.mspx
So if the scan shows you are clean on Feb. 2 and do not use the PC on Feb. 3, you should be OK. :)
Most antivirus programs claim to spot/stop this worm if you get the latest updates.

Quote:

---

Originally Posted by liam858

AFAIK, the virus will destroy the files, so make sure your defences are up, and if it breaches them, start looking for some freeware file recovery apps.


Liam

---

When you say destroy, you mean erased? So regular recover apps should be able to recover them (hopefully)?

No, it overwrites the content and leaves the directory entry intact. Recovery would be incredibly difficult, and would probably only find partial contents.

So it would be pointless to go to someone and waste time trying to recover. Good to know. Lots of time saved.

Microsoft's Windows Live Safety Center Beta Web site provides the ability to choose “Protection Scan” to ensure that systems are free of infection.
http://safety.live.com/

Microsoft's Windows OneCare Live Beta, (English only), provides detection for and protection against the Mywife malware and its known variants.
http://www.windowsonecare.com/

Symantec have released a small removal tool, I'd advise anyone to run it, even if they're fairly certain that they aren't infected:

http://securityresponse.symantec.com...oval.tool.html

Too bad the Symantec tool advises to disable System Restore before using.

It does? I didn't see that anywhere. Anyways I ran it without disabling Sys Restore, it didn't cause any problems.

SuperSparks--Look at #6 under the heading "How to download and run the tool". Of course I can understand why this would be needed if you learn you are infected, since using System Restore would only restore the worm. I think I will run the Symantec tool, as you did, without disabling SP, and disable SR and rerun the scan only if the first pass tells me I am infected.

A link to an interesting article on how quickly BlackWorm was identified and captured by most of the AV world...

http://www.pcmag.com/article2/0,1895,1916880,00.asp