Friday, January 20, 2006
A new email worm Nyxem.E is picking up. We are seeing more reports of it. FSAV detects it with update version 2006-01-20_01 published early this morning.

We upgraded Nyxem.E to Radar level 2 due to the increased number of reports.

The worm's destructive payload activates on every third day of the month by replacing the content of user's files with a text string "DATA Error [47 0F 94 93 F4 K5]". Among these files are: DOC, XLS, MDB,
MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP.

The web counter used by the Nyxem worm now shows over 510,000 infections and keeps rising...If the worm keeps this pace, Friday the 3rd of February might be nasty - that's when the destructive payload is programmed to strike for the first time.