During the last few days Virus Monitoring Service of Doctor Web, Ltd. received many questions from users of different anti-virus programs about the promised cyber-doomsday which would occur on February 3, 2006. As the media announced, citing some av-company, that day the attack of the computer worm will destroy information on hundreds of thousands computers worldwide.
Presently, the Virus Monitoring Service of Doctor Web, Ltd. observed a rather high presence of Win32.HLLM.Generic.391 in the mail traffic (this worm is also known as W32/MyWife.d@MM!M24, Email-Worm.Win32.Nyxem.e, Win32.Blackmal.F, W32/Nyxem-D with other antivirus vendors). The worm even holds the 7th position in the Dr.Web top virus chart. But this fact does not give us any grounds to say the scale of its propagation is terrific. Even more, its presence during last two days has considerably diminished which evidently proves the outbreak goes to its end. The Dr.Web virus analysts cannot even say Win32.HLLM.Generic.391 caused a real epidemic – other mail worms, such as Netsky or MyDoom, much more dangerous than the present worm, strongly hold higher positions in the malware chart.
Win32.HLLM.Generic.391 propagates via e-mail, but it will never reach the level of dissemination of MyDoom or Netsky, as its propagating techniques are rather trivial. Being run on a victimized computer, it tries to destroy files of certain anti-virus programs and every third day of a month overwrites document files and archives on hard drives and deletes some security-related programs. Those users who do not have any anti-virus installed on their computers will certainly face the problem of destruction of their information on February 3.
Registered users of Dr.Web have nothing to worry about, as this mailing worm was detected by Dr.Web's heuristic analyzer and thus had no chance to infiltrate systems protected by Dr.Web Anti-virus. Later, the signature for this specific virus was added to Dr.Web virus base under the name of Win32.HLLM.Generic.391, as virus analysts of Doctor Web, Ltd. refer this worm to the Sober family.
The statistics collected and the reports coming from users prove the worm will not cause any global damage but will definitely create a nuisance for careless users. The worm is definitely not of Russian origin, but strangely enough, the panic about this worm started and continues in Russia. And we say once again - use reliable anti-virus program and feel free…of viruses.
