Google
 
Web microonline.net
 

  
 
 


Services
» Product Gallery
» Personal Computers 
» Website Development
» Annual Maintenance  
» Web Space/Hosting
» Product Gallery        
» Computer Peripherals 
» E-Mail Services 
» Search Engine Submit
» Remote Computing
» Video Conferencing
» Softwares
» Printer Repairs
» Monitor Repair
 


Click To Download Fastest Browser That Never Crashes Virus & Adware Proof
Hp Authorised service Center for Onsite Printer Repairs

              DATA Error [47 0F 94 93 F4 K5]

                                            
[Warning]
data error [47 0f 94 93 f4 k5],data error [47 of 94 93 f4 k5]data error virus,ms office recover,word recover,excel recovery,excel recover,word recovery,ms word recovery,access recovery,ms office repairs, ms office repair,ms recovery,word 2000 repair,word 2000 repair tool,excel repair tool,exel 2000 repair tool,ms office recovery software free download, excel recovery software free downloaddata error [47,data error [47 0f 94 93 f4 k5] in ms word,data error [47 0f 94 93 f4 k5] fix tool,data error 47 of 94 93 f4 k5,getting error in word file data error [47 0f 94 93 f4 k5]
,recover files data error [47 of 94 93 f4 k5],download fix tool for data error [47 0f 94 93 f4 k5],removal of virus data error [47 0f 94 93 f4 k5],data error [47 0f 94 93 f4 k5] problem site,data error[47 of 94 93 f4 k5] virus india,data error[47 of 94 93 f4 k5] virus china,data error[47 of 94 93 f4 k5] virus singapore
,data error[47 of 94 93 f4 k5] virus taiwan,data error[47 of 94 93 f4 k5] virus malaysia,data error[47 of 94 93 f4 k5] virus hongkong,data error[47 of 94 93 f4 k5] virus bombay,data error[47 of 94 93 f4 k5] virus mumbai,data error[47 of 94 93 f4 k5] virus chennai
,data error[47 of 94 93 f4 k5] virus madras,data error[47 of 94 93 f4 k5] virus delhi,data error[47 of 94 93 f4 k5] virus new delhi,data error[47 of 94 93 f4 k5] virus gurgoan,data error[47 of 94 93 f4 k5] virus software,data error[47 of 94 93 f4 k5] virus removal software
,data error[47 of 94 93 f4 k5] virus antivirus,w32.blackmal.e repair tools download,how to recover documents from data error [47 0f 94 93 f4 k5],data error 47,data error [47 0f 94 93 f4 k5] free data recovery tool,data error [47 0f 94 93 f4 k5] recovery tools download
,data error [47 of 94 93 f4 k5] mcafee,data error [47 0f 94 93 f4 k5] repair tool download,repair data error 47 0f 94 93 f4 k5,free recovery tool data error [47 0f 94 93 f4 k5],pc-cillin error 47,ms word data error [47 of 94 93 f 4 k 5],ms excel data error [47 of 94 93 f 4 k 5]
,ms access data error [47 of 94 93 f 4 k 5],free download of software to fix the data error [47 0f 94 93 f4 k5] in ms word,data error[47 of 94 93 f4 k5] data recovery,free download data error [47 0f 94 93 f4 k5] removal tool,data recovery for data error [47 0f 94 93 f4 k5] free
,data error 47 of 94 93 f4 k5 error,fix tool for data error[47 of 94 93 f4 k5],win32.nyxem.e@mm,document data error [47 0f 94 93 f4 k5],data error [47 0f 94 93 f4 k5] recovery tools,data error [47 of 93 f4 k5] word us,data error [47 of 93 f4 k5] word uk,data error [47 of 93 f4 k5] word australia
,data error [47 of 93 f4 k5] word america,data error [47 of 93 f4 k5] word london,data error [47 of 93 f4 k5] word ru,data error [47 of 93 f4 k5] word de,word doc recovery data error [47 0f 94 93 f4 k5],recover data error [47 0f 94 93 f4 k5]
,recovery tool data error [47 0f 94 93 f4 k5],data error [47 of 94 93 f4 k5] free recovery,win32.nyxem.e recovery,data error [47 0f 94 93 f4 k5,delete data error [47 0f 94 93 f4 k5],data error [47 0f,data recovery tool for data error [47 of 94 93 f4 k5]
,how to recover the data in microsoft word files the error displayed in ms word file is data error is data 47 0f 94 93 f4 k5],getting data error [47 0f 94 93 f4 k5],free removal tool data error [47 of 94 93 f4 k5],data error [47 of 94 93 f4 k5] removal tool
,downlaod repair tool data error 47 of 94 93 f4 k5,data error [47 0f 94 93 f4 k5] virus removal tool,how to fix data error 47 of 94 93 f4 k5 ?,remove data error [ 47 0f 94 93 f4 k5 ] ,data error [47 0f 94 93 f4 k5] software free downloads,recovery tool for data error [ 47 of 94 93 f4 k5 ]
,xls and doc data error [47 0f 94 93 f4 k5],free download data error [47 0f 94 93 f4 k5],free virus removal for data error [47 of 94 93 f4 k5]

On the 3rd of every month, the virus will overwrite all files that have the extensions found below in the technical description.

Are you getting DATA Error [47 0F 94 93 F4 K5]



For Data Recovery You May Contact Us at 65001468/65527077    

Other Names W32.Blackmal.E@mm, W32/MyWife ,JS/Blackmal.F
                      W32/Kapser.A@mm, W32/MyWife, Win32/Blackmal.F!CME24
                      WORM_GREW.B,WORM_GREW.A,WORM_GREW.E,
                      WORM_VB.AEL,WORM_NYXEM.GEN ,WORM_GREW

Name: Nyxem.E
Alias: W32.Blackmal.E@mm, Kama Sutra, W32/MyWife.d@MM, Email-Worm.Win32.Nyxem.e
Size: 95744
Category: Virus
Platform: Win32
Date of Discovery: January 20, 2006
CME Reference: CME-24

The 'Nyxem.e' is a mass-mailing worm that also tries to spread using remote shares. It also tries to disable security-related and file sharing software as well as destroys files of certain types. It is similar to the 'Email-Worm.Win32.VB.bi' that was found a few days ago.

- Presence of any of the next files in %WINDOWS% folder:

 %WINDOWS%\Rundll16.exe

- Presence of any of the next files in %SYSTEM% folder:

 %SYSTEM%\scanregw.exe
 %SYSTEM%\Update.exe
 %SYSTEM%\Winzip.exe

- Presence of the next file in Startup folder:

 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.exe

- Presence of:

 C:\WINZIP_TMP.exe

- Presence of the next registry keys or entries:

 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
 "ScanRegistry" = "%SYSTEM%\scanregw.exe /scan"


  where %WINDOWS% points to Windows folder (or WinNT on Windows NT based systems)
        %SYSTEM% points to "System" folder on Windows 9x systems and "System32" folder on WinNT systems.

TECHNICAL DESCRIPTION:  
This threat comes by e-mail. It is written in Visual Basic, and is compiled in p-code.
It spreads via e-mail as a mass mailer using it's own SMTP engine and also through network shares.

Has a dangerous payload, as on the 3rd of each month, 30 minutes after the system has been started,
searches for files with the following extension

.dmp .doc .mdb .mde .pdf .pps .ppt .psd .rar .xls .zip

on all available drives, and replaces their content with

"DATA Error [47 0F 94 93 F4 K5]"


The e-mail format is as follows:

Subject: (may be one of the following)

 Word file

Body: (may be one of the following, or a composition i)

 ----- forwarded message -----
 >> forwarded message
 bye
 F**kin Kama Sutra pics
 forwarded message attached.
 hello,
 hi
 i attached the details.
 i just any one see my photos.
 i send the details
 i send the details.
 i send the file.
 It's Free :)
 Note: forwarded message attached.
 OK ?
 Please see the file.
 ready to be F**KED ;)
 Thank you
 The Best Videoclip Ever
 REE! (US$ 0,00)
 What?
 You Must View This Videoclip!

Note: for instance, the (composed) body may be : hello, i send the details

Attachment
(may be an executable or a MIME-encoded executable)

 007.pif                  
 04.pif                   
 677.pif                  
 Arab DSC-00465.jpg   
 document.pif             
 DSC-00465.Pif            
 DSC-00465.pIf            
 eBook.PIF                
 image04.pif              
 New_Document_file.pif    
 photo.pif                
 School.pif               

If the file is MIME-encoded, the attachment may be:

 3.92315089702606E02.UUE
 Attachments[001].B64
 Attachments00.HQX
 Attachments001.BHX
 eBook.Uu
 .mim
 .mim
 Video_part.mim
 WinZip.BHX
 Word_Document.hqx
 Word_Document.uu

In MIME-encoded form, the attachment may also be composed from a predefined list of strings,
so filename may be:

392315089702606E-02            
Clipe                          
Miss                           
Sweet_09                       

and extension may be any of:

.b64
.BHx
.HQX
.mim
.uu 
.UUE

The the executable within MIME-encoded file may be:

 392315089702606E-02,UUE .scR  
 Adults_9,zip .sCR             
 ATT01.zip .sCR                
 Atta[001],zip .SCR            
 Attachments,zip .SCR          
 Attachments[001],B64 .sCr     
 Clipe,zip .sCr                
 New Video,zip .sCr            
 Photos,zip .sCR               
 ,zip .scR                  
 WinZip,zip .scR               
 WinZip.zip .sCR               
 Word XP.zip .sCR              
 Word.zip .sCR                 



Once the executable is run (attachment from e-mail or other way), the virus will do
the following:


1. Copies itself as one or more of the following files:
(also see symptoms above)

 %WINDOWS%\Rundll16.exe
 %SYSTEM%\scanregw.exe
 %SYSTEM%\Update.exe
 %SYSTEM%\Winzip.exe


2. Creates autorun registry entry:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry" = "%SYSTEM%\scanregw.exe /scan"]


3. Modifies/sets the registry keys:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
 "WebView" = 0
 "ShowSuperHidden" = 0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
"FullPath" = 1


4. Harvests e-mail addresses from files with extension:

.DBX .EML .HTM .IMH .MBX .MSF .MSG .NWS .OFT .TXT .VCF

also scans inside files whose filenames match the strings "CONTENT." or "TEMPORARY"
for e-mail addresses, but avoids e-mail addresses that contain:

@HOTMAIL
@HOTPOP
@YAHOOGROUPS
ANTI
AVG
CA.COM
CILLIN
EEYE
GROUPS.MSN
KASPER
MCAFEE
MICROSOFT
NOMAIL.YAHOO.COM
NORTON
PANDA
SCRIBE
SECUR
SPAM
SYMANTEC
TREND
TRUST
VIRUS

The virus will send itself to the harvested e-mail addresses in the format described earlier.


5. Network shares scan and propagation.

Enumerates available shares, and also checks "Personal" and "Recent" entries in

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

The virus may replace randomly one of the files from the found folders, with a copy of itself, barring .exe extension.

Attempts to copy itself to network shares as:

New WinZip File.exe
Zipped Files.exe
movies.exe
WINZIP_TMP.exe

Also as

 C$\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.exe

and deletes

 C$\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

Also, attempts to delete files from folders:

\C$\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus
\C$\Program Files\Common Files\symantec shared
\C$\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal
\C$\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro
\C$\Program Files\McAfee.com\Agent
\C$\Program Files\McAfee.com\shared
\C$\Program Files\McAfee.com\VSO
\C$\Program Files\NavNT
\C$\Program Files\Norton AntiVirus
\C$\Program Files\Panda Software\Panda Antivirus 6.0
\C$\Program Files\Panda Software\Panda Antivirus Platinum
\C$\Program Files\Symantec\LiveUpdate
\C$\Program Files\Trend Micro\Internet Security
\C$\Program Files\Trend Micro\PC-cillin 2002
\C$\Program Files\Trend Micro\PC-cillin 2003


6. Attempts to delete files from "Program Files" inside the following folders:

\DAP\*.dll                                 
\BearShare\*.dll                           
\Symantec\LiveUpdate\*.*                   
\Symantec\Common Files\Symantec Shared\*.* 
\Norton AntiVirus\*.exe                    
\Alwil Software\Avast4\*.exe               
\McAfee.com\VSO\*.exe                      
\McAfee.com\Agent\*.*                      
\McAfee.com\shared\*.*                     
\Trend Micro\PC-cillin 2002\*.exe          
\Trend Micro\PC-cillin 2003\*.exe          
\Trend Micro\Internet Security\*.exe       
\NavNT\*.exe                               
\Morpheus\*.dll                            
\Kaspersky Lab\Kaspersky Anti-Virus Personal\*.ppl 
\Kaspersky Lab\Kaspersky Anti-Virus Personal\*.exe 
\Grisoft\AVG7\*.dll                                
\TREND MICRO\OfficeScan\*.dll                      
\Trend Micro\OfficeScan Client\*.exe               
\LimeWire\LimeWire 4.2.6\LimeWire.jar              

and also

\HyperTechnologies\Deep Freeze\*.exe

the virus also looks for registry keys:

Software\INTEL\LANDesk\VirusProtect6\CurrentVersion
SOFTWARE\Symantec\InstalledApps
SOFTWARE\KasperskyLab\InstalledProducts\Kaspersky Anti-Virus Personal
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Iface.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Panda Antivirus 6.0 Platinum

in order to delete various files.


7. Terminates applications whose caption contain any of the strings:

SYMANTEC  
SCAN      
KASPERSKY 
VIRUS     
MCAFEE    
TREND MICRO
NORTON    
REMOVAL   


8. Deletes registry entries from:

[Software\Microsoft\Windows\CurrentVersion\Run]
[Software\Microsoft\Windows\CurrentVersion\RunServices]

that contain the following strings:

APVXDWIN
avast!
AVG_CC
AVG7_CC
AVG7_EMC
AVG7_Run
Avgserv9.exe
AVGW
BearShare
ccApp
CleanUp
defwatch
DownloadAccelerator
kaspersky
KAVPersonal50
McAfeeVirusScanService
MCAgentExe
McRegWiz
MCUpdateExe
McVsRte
MPFExe
MSKAGENTEXE
MSKDetectorExe
NAV Agent
NPROTECT
OfficeScanNT Monitor
PCCClient.exe
pccguide.exe
PCCIOMON.exe
PCCIOMON.exe
PCClient.exe
PccPfw
Pop3trap.exe
rtvscn95
ScanInicio
ScriptBlocking
SSDPSRV
TM Outbreak Agent
tmproxy
Vet Alert
VetTray
VirusScan Online
vptray
VSOCheckTask


9. Notifies the author for infection, by connecting to:

"http://webstats.web.rcn.net/cgi-bin/Count.cgi?df=?????"


10. May display a tray icon in systray, saying "Update Please wait", and also attempt to
download an update of itself.



Additional notes:

- the virus also carries an upx packed version of MSWINSCK.OCX, which will register using
  "regsvr32 /s MSWINSCK.OCX" command.

For Data Recovery You May Contact Us at 65001468/65527077       


 

 

  All Rights Reserved Copyright 1999-2006.  Micro Technologies .Email: info@microonline.net  www.microonline.net
 Tel 91-22-65001468/65527077   Mumbai  India.