The Kama Sutra worm, also known as Blackworm,, is a type of malware (malicious software) that infects PCs using Microsoft Windows. It is also known by antiviruses as Grew.a, Grew.b, Blackmal.e, Nyxem.e, Nyxem.d, Mywife.d, Tearec.a and CME-24.
Blackworm spreads mainly by sending infected email attachments, but also infects other computers by copying itself over network shares. The virus removes antivirus programs from remote computers before attempting to infect them. When first installed, it copies itself to the Windows and system directories. It uses filenames that resemble those of legitimate Windows system files in an attempt to remain hidden. It activates on the third day of each month; the first known activation happened on February 3, 2006. On activation, the virus overwrites data files of many common types, including Word, Excel, and PowerPoint documents; ZIP and RAR archives; and PDFs. It can destroy files on fixed and removable drives and tries, but fails, to affect data on network drives. It also attempts to disable antivirus programs by removing the registry entries that automatically run them and deleting the antivirus programs directly.
The virus visits a tracking Web page each time it infects a computer. Over 300,000 unique IPs visited that site, suggesting that at least that many computers suffered infection. It is not known how many of them remained infected long enough to trigger the virus’s payload.