NEWS FROM THE LAB - Sunday, February 5, 2006

Nyxem: nothing happened? Posted by Mikko @ 13:46 GMT

So, Nyxem.E had infected hundreds of thousands of computers over the last two weeks. It activated on Friday, overwriting data. But almost nobody reported any problems. So what happened?

Excel DATA Error [47 0F 94 93 F4 K5]Well, probably several things, including:

- The amount of machines that were really infected still on Friday was much smaller than the total amount of machines that got infected (and cleaned) during the whole outbreak. This number is probably in the tens of thousands. Which is not a lot of computers out of, say, one billion computers in the world.

- Many of the infected machines were not rebooted on Friday. They were simply running all the time. The worm only does damage when you start the machine on the 3rd.

- Many infected home machines were shut down all of Friday, and nothing happened. People went to movies, bars, parties on Friday night instead of surfing.

- The media coverage on the whole incident prompted many people to check their system and clean them up in time.

So, does this mean there weren't any problems reported, anywhere? Well, no. We had some isolated support calls to our country offices from home users who were hit. And a partner company of ours in USA was contacted with a company that had one of their Windows servers hit.

And there were some unconfirmed online reports of problems. You can find examples if you dig online forums and usenet groups. See some examples below:

  Newsgroups: microsoft.public.excel.misc
   From: "=?Utf-8?B?bXVydWdhbl9oc0B5YWhvby5jb20=?="
   Subject: data error while opening files
   Date: Wed, 18 Jan 2006 22:18:02 -0800

   when i open excel or word existing file i getting contents as "DATAError
   [47 0F 94 93 F4 K5]" instead of my saved data.
   pls help me solving. My all word & excel files are have same problem.
  Newsgroups: microsoft.public.excel.misc
   From: "saran"
   Subject: Re: data error while opening files
   Date: 2 Feb 2006 23:18:19 -0800

   i am also having the same problem i thing the virus webmal can corrupt
   the dat if u got the solution pls send it to me
  Newsgroups: Yummypinays
   From: Elpidio Garcia
   Date: Fri, 3 Feb 2006 05:03:39 +0000 (GMT)
   Subject: [YP] HHHHHHHHHHHHelp!!!!!!! anyone...

   ...i found out that all my files particularly office docs were corrupted
   and only shows this message everytime i open my files,
   DATA Error [47 0F 94 93 F4 K5]
  Newsgroups: microsoft.public.fr.excel
   From: aougarferhat
   Subject: c'est quoi data error 47 0F 94 93 F4 K5?
   Date: Sat, 4 Feb 2006 14:41:45 -0800