File-Destroying Worm Causes Little Damage (in Asia and Europe)

[Algorem]

http://hosted.ap.org/dynamic/stories/F/FRIDAY_WORM?SITE=OHALL&SECTION=HOME&TEMPLATE=DEFAULT

Feb 3, 10:21 AM EST

By ANICK JESDANUN
AP Internet Writer

A file-destroying computer worm set to activate Friday caused relatively little damage in Asia and Europe, although one Italian city shut down computers as a precaution.

Hundreds of thousands of computers were believed to be infected, but many companies and individuals had time to clean up their machines this week after security vendors and media outlets warned of the "Kama Sutra" worm...

Experts had warned earlier that the worm, also known as "CME-24," "BlackWorm," or "Mywife.E," could corrupt documents using the most common file types, including ".doc," ".pdf," and ".zip." The worm, nicknamed after the Hindu love manual Kama Sutra because of the pornographic come-ons in e-mails spreading it, affects most versions of Microsoft Corp.'s Windows operating system, prompting the software giant to issue a warning Tuesday...

He said damage is high among those hit, but many businesses should already be protected by anti-virus software. Home users and smaller companies without the latest software updates may be more vulnerable.

---

[Javaman]

1. How was it known that this was going to happen today? n/t

[kevsand]

2. I'm assuming that several teams

decompiled the executable file. It's a relatively straightforward process with the right tools, and any kind of calendar based trigger would be fairly obvious to spot. I think I read that it's either the 3rd of each month, or maybe the first Friday of each month (can't remember which). I think it will repeat each month from here on out.