One of the machines at the place I work was infected with the Nyxem virus. This is probably the worst virus I have ever encountered, to be honest I havent dealt with that many but this really holds it’s own up there.
| Name |
|
|---|---|
| Type |
|
| Side effects |
|
| Aliases |
|
As you can see it really does its best to fcuk with your systems. I had noticed when it installed itself that it tried to close all running applications, send out mass mailing from your system and disable the antivirus. Not only did it disable the antivirus, it damn-well deleted the executable file of it aswell!
OK, so it running rampage throughout the system. I go into regedit and search for the value scanregw (which names itself “Scan Registry” in the registry). This is the file that boots on startup and makes your life a living hell. Once that is deleted, its a simple sweep for virii and the files are deleted.
Is that it? No.
The virus also sends itself to email address in your contacts and ones it can find in text files on your computer. It creates at least 7 copies of the infected .exe on network shares (being in a company this is very very dangerous and of course easy to do when you use the shares daily).
So now it is deleted, the virus scanner is clearing up the rest of the shares and I can breathe a sigh of relief. If you need help, I will write a page on how to delete the virus from your system.
Peace.
Locate Me