CME-24 (a.k.a "Nyxem.E" by F-Secure and "Blackmal.E@mm" by Symantec) is a mass-mailing worm that spreads to remote shares, disables AV software, and destroys user's data files. When executed, the worm copies itself to the Windows/System folder. On the 3rd day of every month the worm will delete user's data files. The worm then collects e-mail addresses from the infected system and sends itself as attachment in the infected e-mail. The e-mail subject can be one the following:
1.1. The Best Videoclip Ever
1.2. School girl fantasies gone bad
1.3. A Great Video
1.4. Arab sex DSC-00465.jpg
1.5. give me a kiss
1.6. *Hot Movie*
1.7. Fw: Funny 🙂
1.8. Fwd: Photo
1.9. Fwd: image.jpg
1.10. Fw: Sexy
1.11. Re:
1.12. Fw:
1.13. Fw: Picturs
1.14. Fw: DSC-00465.jpg
1.15. Word file
1.16. eBook.pdf
1.17. the file
1.18. Part 1 of 6 Video clipe
1.19. You Must View This Videoclip!
1.20. Miss Lebanon 2006
1.21. Re: Sex Video
1.22. My photos
I received the Miss Lebonon one on my personal email account. So be on the look out.
Da Chief