Security threats Toolkit

Nyxem destruction begins early

Graeme Wearden ZDNet.co.uk

Published: 01 Feb 2006 17:30 GMT

The Nyxem virus has started wiping crucial files from infected PCs, several days earlier than expected.

Nyxem is programmed to delete Word, Excel, PowerPoint, and PDF files on 3 February, giving infected users less than two days to clean up their systems. But security firm F-Secure said late on Tuesday that some users had lost important files after becoming infected already by Nyxem, because the clock time on their PC was wrong.

"If you're infected and your clock is not set right, things could start to happen at any time — even though the official activation time is the 3 February. We've already received first reports from users who've had files on their system overwritten by the worm," warned Mikko Hyppönen, director of antivirus research at F-Secure, in a blog posting.

All the major antivirus vendors have released patches for Nyxem, but F-Secure estimates that thousands of PCs are still infected. The bulk of these PCs are thought to be located in India, Turkey and Peru, but companies worldwide could be hit by a traffic spike on Friday as the virus will mail copies of itself to contacts in a user's address book.Easynet has warned some of its customers that they have been infected by Nyxem. It appears that other UK ISPs are not following this lead, although Wanadoo said on Wednesday afternoon that it does inform its customers if it realises they have fallen victim to a virus.