DATA Error [47 0F 94 93 F4 K5]

Kamasutra virus Recovery is possible (Blackmal )

data error [47 0f 94 93 f4 k5],data error [47 of 94 93 f4 k5]data error virus,data error [47,data error [47 0f 94 93 f4 k5] in ms word,data error [47 0f 94 93 f4 k5] fix tool,data error 47 of 94 93 f4 k5,getting error in word file data error [47 0f 94 93 f4 k5]ms office recover,word recover,excel recovery,excel recover,word recovery,ms word recovery,access recovery,ms office repairs, ms office repair,ms recovery,word 2000 repair,word 2000 repair tool,excel repair tool,exel 2000 repair tool, ms office recovery software free download, excel recovery software free download
,recover files data error [47 of 94 93 f4 k5],download fix tool for data error [47 0f 94 93 f4 k5],removal of virus data error [47 0f 94 93 f4 k5],data error [47 0f 94 93 f4 k5] problem site,data error[47 of 94 93 f4 k5] virus india,data error[47 of 94 93 f4 k5] virus china,data error[47 of 94 93 f4 k5] virus singapore
,data error[47 of 94 93 f4 k5] virus taiwan,data error[47 of 94 93 f4 k5] virus malaysia,data error[47 of 94 93 f4 k5] virus hongkong,data error[47 of 94 93 f4 k5] virus bombay,data error[47 of 94 93 f4 k5] virus mumbai,data error[47 of 94 93 f4 k5] virus chennai
,data error[47 of 94 93 f4 k5] virus madras,data error[47 of 94 93 f4 k5] virus delhi,data error[47 of 94 93 f4 k5] virus new delhi,data error[47 of 94 93 f4 k5] virus gurgoan,data error[47 of 94 93 f4 k5] virus software,data error[47 of 94 93 f4 k5] virus removal software
,data error[47 of 94 93 f4 k5] virus antivirus,w32.blackmal.e repair tools download,how to recover documents from data error [47 0f 94 93 f4 k5],data error 47,data error [47 0f 94 93 f4 k5] free data recovery tool,data error [47 0f 94 93 f4 k5] recovery tools download
,data error [47 of 94 93 f4 k5] mcafee,data error [47 0f 94 93 f4 k5] repair tool download,repair data error 47 0f 94 93 f4 k5,free recovery tool data error [47 0f 94 93 f4 k5],pc-cillin error 47,ms word data error [47 of 94 93 f 4 k 5],ms excel data error [47 of 94 93 f 4 k 5]
,ms access data error [47 of 94 93 f 4 k 5],free download of software to fix the data error [47 0f 94 93 f4 k5] in ms word,data error[47 of 94 93 f4 k5] data recovery,free download data error [47 0f 94 93 f4 k5] removal tool,data recovery for data error [47 0f 94 93 f4 k5] free
,data error 47 of 94 93 f4 k5 error,fix tool for data error[47 of 94 93 f4 k5],win32.nyxem.e@mm,document data error [47 0f 94 93 f4 k5],data error [47 0f 94 93 f4 k5] recovery tools,data error [47 of 93 f4 k5] word us,data error [47 of 93 f4 k5] word uk,data error [47 of 93 f4 k5] word australia
,data error [47 of 93 f4 k5] word america,data error [47 of 93 f4 k5] word london,data error [47 of 93 f4 k5] word ru,data error [47 of 93 f4 k5] word de,word doc recovery data error [47 0f 94 93 f4 k5],recover data error [47 0f 94 93 f4 k5]
,recovery tool data error [47 0f 94 93 f4 k5],data error [47 of 94 93 f4 k5] free recovery,win32.nyxem.e recovery,data error [47 0f 94 93 f4 k5,delete data error [47 0f 94 93 f4 k5],data error [47 0f,data recovery tool for data error [47 of 94 93 f4 k5]
,how to recover the data in microsoft word files the error displayed in ms word file is data error is data 47 0f 94 93 f4 k5],getting data error [47 0f 94 93 f4 k5],free removal tool data error [47 of 94 93 f4 k5],data error [47 of 94 93 f4 k5] removal tool
,downlaod repair tool data error 47 of 94 93 f4 k5,data error [47 0f 94 93 f4 k5] virus removal tool,how to fix data error 47 of 94 93 f4 k5 ?,remove data error [ 47 0f 94 93 f4 k5 ] ,data error [47 0f 94 93 f4 k5] software free downloads,recovery tool for data error [ 47 of 94 93 f4 k5 ]
,xls and doc data error [47 0f 94 93 f4 k5],free download data error [47 0f 94 93 f4 k5],free virus removal for data error [47 of 94 93 f4 k5]

On the 3rd of every month, the virus will overwrite all files that have the extensions found below in the technical description.

Are you getting DATA Error [47 0F 94 93 F4 K5]

Are you getting DATA Error [47 0F 94 93 F4 K5]

Other Names W32.Blackmal.E@mm, W32/MyWife ,JS/Blackmal.F

W32/Kapser.A@mm, W32/MyWife, Win32/Blackmal.F!CME24
WORM_GREW.B,WORM_GREW.A,WORM_GREW.E,

WORM_VB.AEL,WORM_NYXEM.GEN ,WORM_GREW

The 'Nyxem.e' is a mass-mailing worm that also tries to spread using remote shares. It also tries to disable security-related and file sharing software as well as destroys files of certain types. It is similar to the 'Email-Worm.Win32.VB.bi' that was found a few days ago.

Installation to system

Nyxem.E is written in Visual Basic and is compiled as p-code. The size of the main executable is about 95 kilobytes. When the worm's file is run, it first opens WinZip as a decoy. On our test systems it also blocked keyboard and mouse so the only option was to press CTRL + ALT + DEL and to log off.

During the installation phase the worm copies its file to several locations:

%Windows%\rundll16.exe
%System%\scanregw.exe
%System%\Update.exe
%System%\Winzip.exe

where '%Windows%' presents the main Windows folder. On Windows systems, it is usually C:\WINDOWS\ folder. The '%System%' represents Windows System folder.

The worm creates the following Registry key value for its file to activate itself on every system startup:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry" = "%System%\scanregw.exe /scan"


Spreading in e-mails

The worm collects e-mail addresses from files with following extensions:

.HTM
.DBX
.EML
.MSG
.OFT
.NWS
.VCF
.MBX
.IMH
.TXT
.MSF

The worm searches for files with these extensions in Internet Explorer cache folders. E-mail addresses that have any of the following substrings are ignored by the worm:

SYMANTEC
MCAFEE
VIRUS
TREND
PANDA
SECUR
SPAM
NORTON
ANTI
CILLIN
CA.COM
KASPER
TRUST
AVG
GROUPS.MSN
NOMAIL.YAHOO.COM
SCRIBE
EEYE
MICROSOFT
@HOTMAIL
@HOTPOP
@YAHOOGROUPS

The worm sends itself as attachment in the infected e-mail. The e-mail subject can be one the following:

The Best clip Ever
School girl fantasies gone bad
A Great 
 Kama Sutra pics
Arab  DSC-00465.jpg
give me a kiss
*Hot Movie*
Fw: Funny :)
Fwd: Photo
Fwd: image.jpg
Fw: y
Re:
Fw:
Fw: Picturs
Fw: DSC-00465.jpg
Word file
eBook.pdf
the file
Part 1 of 6  clipe
You Must View This clip!
Miss Lebanon 2006
Re:  
My photos

The message body may be one of the following:

Note: forwarded message attached.
 Yahoo Groups
 Kama Sutra pics
ready to be F*CKED ;)
forwarded message attached.
! FREE! (US$ 0,00)
Please see the file.
>> forwarded message
----- forwarded message -----
i just any one see my photos. It's Free :)

how are you?
i send the details.
OK ?

The worm usually attached itself to e-mail messages as an executable file. It uses one the following names in attachment:

007.pif
School.pif
04.pif
photo.pif
DSC-00465.Pif
image04.pif
677.pif
New_Document_file.pif
eBook.PIF
document.pif
DSC-00465.pIf

Sometimes, the worm MIME-encodes the file. In these cases, the attachment name can be
one of the following:

_part.mim
Attachments00.HQX
Attachments001.BHX
Attachments[001].B64
3.92315089702606E02.UUE
.mim
.mim
Original Message.B64
WinZip.BHX
eBook.Uu
Word_Document.hqx
Word_Document.uu

The filename inside MIME-encoding is one of the following:

New ,zip .sCr
Attachments,zip .SCR
Atta[001],zip .SCR
Clipe,zip .sCr
WinZip,zip .scR
_9,zip .sCR
Photos,zip .sCR
Attachments[001],B64 .sCr
392315089702606E-02,UUE .scR
,zip .scR
WinZip.zip .sCR
ATT01.zip .sCR
Word.zip .sCR


Spreading to network shares

The worm has several network spreading routines. One of them enumerates all available shares, then reads the values of the following Registry keys:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent"
"Personal"

The above Registry key values point to user's folders where personal documents and recently opened files are stored. If such foder is found, the worm opens it, enumerates files there, "borrows" one file name (randomly selected) and adds EXE extension to it. Then the worm copies itself to network shares with that name. If the worm does not find any files in those folders it copies itself to network shares with the following names:

New WinZip File.exe
Zipped Files.exe
movies.exe

The other network spreading routine searches for specific network shares and tries to copy itself using one of the following filenames:

\Admin$\WINZIP_TMP.exe
\c$\WINZIP_TMP.exe
\c$\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.exe

At the same time the worm deletes the following file:

\c$\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

Before spreading the worm checks whether a remote computer has any of the following folders and if it does, the worm tries to delete all files from that folder:

\C$\Program Files\Norton AntiVirus
\C$\Program Files\Common Files\symantec shared
\C$\Program Files\Symantec\LiveUpdate
\C$\Program Files\McAfee.com\VSO
\C$\Program Files\McAfee.com\Agent
\C$\Program Files\McAfee.com\shared
\C$\Program Files\Trend Micro\PC-cillin 2002
\C$\Program Files\Trend Micro\PC-cillin 2003
\C$\Program Files\Trend Micro\Internet Security
\C$\Program Files\NavNT
\C$\Program Files\Panda Software\Panda Antivirus Platinum
\C$\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal
\C$\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro
\C$\Program Files\Panda Software\Panda Antivirus 6.0
\C$\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus

The worm also creates a scheduled task to run the worm's files on remote computer with system priviledges at the 59th minute of the current hour.

Infects To

The worm has a dangerous payload. If the date is equal to 3 (3rd of February, 3rd of March, etc) and the worm's UPDATE.EXE file is run, it destroys files with those extensions on all available drives:

*.doc
*.xls
*.mdb
*.mde
*.ppt
*.pps
*.zip
*.rar
*.pdf
*.psd
*.dmp

The files' contens get replaced with a text string "DATA Error [47 0F 94 93 F4 K5]". The payload is activated 30 minutes after the worm's file UPDATE.EXE is loaded into memory (basically 30 minutes after logon). We can confirm that the payload works at least on Windows XP. When the payload is activated, the worm enumerates all logical drives and damages files on them in a loop. So it should damage files on all drives that have a letter, including network drives. However the worm fails to do so on network drives at least in our test environment. Files on local and removable drives (including USB memory) were damaged by the payload.

The worm attempts to disable several security-related and file sharing programs. It deletes startup key values from the Registry if they contain any of the following:

NPROTECT
ccApp
ScriptBlocking
MCUpdateExe
VirusScan Online
MCAgentExe
VSOCheckTask
McRegWiz
CleanUp
MPFExe
MSKAGENTEXE
MSKDetectorExe
McVsRte
PCClient.exe
PCCIOMON.exe
pccguide.exe
Pop3trap.exe
PccPfw
PCCIOMON.exe
tmproxy
McAfeeVirusScanService
NAV Agent
PCCClient.exe
SSDPSRV
rtvscn95
defwatch
vptray
ScanInicio
APVXDWIN
KAVPersonal50
kaspersky
TM Outbreak Agent
AVG7_Run
AVG_CC
Avgserv9.exe
AVGW
AVG7_CC
AVG7_EMC
Vet Alert
VetTray
OfficeScanNT Monitor
avast!
DownloadAccelerator
BearShare

The following startup Registry keys are affected:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]

In addition the worm deletes files from the following subfolders in the Program Files folder:

\DAP\*.dll
\BearShare\*.dll
\Symantec\LiveUpdate\*.*
\Symantec\Common Files\Symantec Shared\*.*
\Norton AntiVirus\*.exe
\Alwil Software\Avast4\*.exe
\McAfee.com\VSO\*.exe
\McAfee.com\Agent\*.*
\McAfee.com\shared\*.*
\Trend Micro\PC-cillin 2002\*.exe
\Trend Micro\PC-cillin 2003\*.exe
\Trend Micro\Internet Security\*.exe
\NavNT\*.exe
\Kaspersky Lab\Kaspersky Anti-Virus Personal\*.ppl
\Kaspersky Lab\Kaspersky Anti-Virus Personal\*.exe
\Grisoft\AVG7\*.dll
\TREND MICRO\OfficeScan\*.dll
\Trend Micro\OfficeScan Client\*.exe
\LimeWire\LimeWire 4.2.6\LimeWire.jar
\Morpheus\*.dll