On Thursday 2 February 2006 technicians in Milan found a worm on the city's network, could not clean every machine by morning, and switched off ten thousand computers. "It has spread to all our computers," Giancarlo Martella, the councillor responsible for technological innovation, told the Associated Press. "Knowing how destructive it is, we turned off all personal computers to avoid losing our data." Only the registry office stayed open; its terminals stored nothing. The worm — Nyxem, Blackworm or, after the come-ons in its email, Kama Sutra — was set to wake on the third of each month, half an hour after a machine started, and replace the contents of eleven kinds of file, from Office documents to ZIP archives, with the line "DATA Error [47 0F 94 93 F4 K5]".
It had been travelling since the middle of January as an email attachment, under subject lines such as "Miss Lebanon 2006" and "The Best Videoclip Ever". Once opened it removed most anti-virus products, checking again every hour, and copied itself to any network share it could write to. It also announced its arrival. Each new infection requested a page from a public statistics counter at webstats.web.rcn.net, which kept a running total; CAIDA, the network-measurement group at the San Diego Supercomputer Center, later counted new infections from 23:40 UTC on Sunday 15 January. Anyone could watch the number climb, and for a fortnight the outbreak was measured against it.
The total could not be taken at face value. On 24 January Joe Stewart of the security company LURHQ read about 679,000 infections off the counter; two days later he put the real number nearer 300,000, and the SANS Internet Storm Center, working from the counter's own logs, arrived at about the same. Curiosity accounted for some of the difference, but not all: LURHQ found someone driving the count up from 279 distributed computers, presumably compromised, and by 30 January the page claimed millions. The warnings rose with the number. Kaspersky Lab and Microsoft both issued alerts on Monday 30 January, and by 2 February F-Secure had two reports of files already lost on machines whose clocks were wrong.
Then the Friday came, and little happened. "It's been pretty quiet," said Mikko Hypponen of F-Secure, who noted that most infected machines were home computers, not switched on until their owners got home. MessageLabs had seen up to 11,000 machines a day being cleaned, and Ken Dunham of iDefense judged that "a significant percentage of infected computers were successfully cleaned" before the deadline. The careful estimate came later. David Moore and Colleen Shannon of CAIDA discarded 91.1 per cent of the counter's hits as denial-of-service traffic and still put the victims at between 469,507 and 946,835 machines in more than 200 countries, the largest share in India, then Peru; at least 45,401 of them also advertised spyware or a bot in their browser strings. The damage, they concluded, was impossible to catalogue.
Pictures of Leopard
In mid-February latestpics.tgz appeared on the MacRumors forums, offered as pictures of Mac OS X 10.5, Leopard. Inside, a program wore a JPEG icon. Opened, it hooked into other applications through an Input Manager, marked them with the word "oompa" and offered itself to the user's iChat buddies — in practice only those its Bonjour list could see on the local network; a bug left infected programs unable to start. Sophos called OSX/Leap-A "the first real virus for the Mac OS X platform"; Andrew Welch of Ambrosia Software called it a Trojan horse, "because it doesn't self-propagate externally"; Apple said it "is not a virus" but malicious software a user had to download and run. On 17 February Symantec identified Inqtana, a Java proof of concept that used a Bluetooth flaw Apple had patched in 2005 and was coded to stop after 24 February. On 21 February the Internet Storm Center relayed heise's warning, based on Michael Lehn's demonstration, that Safari as shipped would unpack a downloaded archive and run the shell script inside, dressed as a film. Security Update 2006-001, in early March, made Safari, Mail and iChat warn before opening unfamiliar files.
Front Pages in .dk
The dispute over twelve cartoons of the Prophet Muhammad, first printed by the Danish newspaper Jyllands-Posten on 30 September 2005, had become international by late January 2006. Its online form was mostly the replaced front page. The Danish engineering paper Ingeniøren reported on 6 February that 348 Danish websites had been hacked over the weekend; Ulf Munkedal of the security firm FortConsult put Denmark's normal level at five to ten attacks a week and said the attackers were scanning the .dk domain for sites that were easy to break. Roberto Preatoni of Zone-H, an archive of defacements compiled largely from the defacers' own submissions, counted about 200 Danish sites on Tuesday 7 February alone, against a baseline he put at five to ten a day. By 22 February his tally since 21 January stood at 2,817 .dk defacements, "at least 10 times, maybe more like 20 times" what he would expect. Most targets, technology journals reported, belonged to small organisations; Jyllands-Posten itself was flooded with traffic but not defaced. Defacing, Preatoni warned, "takes absolutely the same skills as hacking".
Two Kinds of Threat
India held the largest share of the worm's victims. LURHQ's breakdown, reported on 30 January, put nearly 80,000 infected machines there, about five times the American figure, with Peru second, and CAIDA's later estimate placed between 151,341 and 273,013 of the victims in India, roughly three in ten. On the Friday itself Ajit Pillai, India manager for WatchGuard Technologies, said about a tenth of his customers had been infected but had "followed the remedies and managed to avoid any problem"; unconfirmed reports said some Indian companies had lost files. Before the next trigger date, on 2 March, the Indian Computer Emergency Response Team called the worm "destructive in nature", said it cut user files to 1KB, and told users to keep backups and to block executable attachments at the mail gateway.
In between, the Reserve Bank of India wrote to every commercial bank about a threat that would outlast the worm. Its letter of 16 February 2006 cautioned them about phishing, in which a forged email leads a customer to a counterfeit copy of a bank's website, and years later ministers' answers in the Lok Sabha were still citing it among the Bank's defences against internet-banking fraud. Nyxem was built to destroy files and announce itself; phishing was built to take money unnoticed. The Bank's answer hardened into a second password for online card payments from August 2009, and in April 2010 an adjudicating officer ordered ICICI Bank to compensate a customer who had been phished, a case June 2008's edition follows.
Nuance agrees to buy Dictaphone
On 8 February 2006 Nuance Communications, of Burlington, Massachusetts, agreed to pay $357 million for Dictaphone, of Stratford, Connecticut, whose lineage ran back to a wax-cylinder recorder made by Alexander Graham Bell and two associates in 1881. Dictaphone's dictation and transcription systems served more than 4,000 hospital and outpatient facilities and about 400,000 physicians. Nuance put worldwide spending on typing up doctors' dictation at about $15 billion a year, and its chief executive, Paul Ricci, said the combined companies would help speed the adoption of speech recognition "to eliminate most manual transcription for healthcare" in North America within the decade. The deal closed on 31 March, at $359 million. In that month's issue of the journal Machine Learning, Matthew Richardson and Pedro Domingos of the University of Washington set out Markov logic networks, which join first-order logic to probabilistic graphical models by attaching a weight, learned from relational databases, to each formula. Doctors' notes stayed the prize: in March 2025 Microsoft, Nuance's owner since 2022, unveiled Dragon Copilot, built to listen to clinical conversations and take the notes.
Windows Defender's second beta, and a false alarm
Microsoft posted the second beta of Windows Defender on 13 February 2006, and Bill Gates announced it the next day at the RSA Conference in San Jose. It was the anti-spyware program Microsoft had acquired with Giant Company Software in December 2004, renamed from Windows AntiSpyware and largely rebuilt: its Visual Basic engine was rewritten in C++, it ran as a Windows service, a 64-bit edition appeared, and tools such as the Secure Shredder were dropped. It was free for Windows XP, 2000 and Server 2003, though only on copies that passed Microsoft's Genuine Advantage check, and was to ship in Windows Vista. The beta it replaced had just misfired: a signature update on Thursday 9 February flagged a registry key used by Symantec AntiVirus Corporate Edition and Symantec Client Security as Bancos-A, a password-stealing Trojan, and deleting it as advised disabled Symantec's software. Microsoft corrected the definitions next morning; both companies expected few customers to be affected, and Norton's consumer products were not. Windows 8 made Defender a full anti-virus program, as October 2012's edition records.
⏳ Time capsule — February 2006
- From 10 to 26 February Turin held the Winter Olympics: 2,563 athletes from a record 80 national Olympic committees contested 84 events. Germany led the medal table with eleven golds, and Shizuka Arakawa won Japan's first Olympic gold in figure skating.
- On 10 February Egypt beat Côte d'Ivoire 4–2 on penalties after a goalless final at the Cairo International Stadium, watched by 74,100, to win the Africa Cup of Nations for a record fifth time.
- On 11 February Steve Fossett brought the GlobalFlyer down at Bournemouth, in England, 76 hours and 45 minutes after leaving the Kennedy Space Center in Florida, setting the absolute record for distance without landing at 25,766 statute miles. A generator failure at 40,000 feet had left him about 25 minutes of battery power, and ice inside the canopy made the landing almost blind.
- On 25 February, at 7:16 p.m. Eastern time, the world's population was projected to pass 6.5 billion.
What the Counter Started
Nyxem belonged to an older idea of malware: mailed to everyone, built to wreck files for no evident gain, and loud enough to publish its own progress. The money was already moving to quieter trades, among them the rented botnet that January's edition records, and when destruction returned it came as a weapon: thirty thousand workstations wiped at Saudi Aramco in August 2012, and a poisoned Ukrainian accounting update in June 2017 that cost companies across the world billions. The counter aged better than the worm. Listening to malware's own calls home became a standard way of counting infections, and the argument over the count came with it: F-Secure's Conficker figures in January 2009 were doubted on grounds Nyxem's watchers would have recognised.
The month's smaller stories ran the same course, from novelty to routine. Whether Leap-A was a virus stopped mattering: like the counterfeit Flash installer that began Flashback, it needed the user's own click, and Flashback had more than 600,000 Macs calling home by April 2012. Apple's answer of March 2006, a warning before an unfamiliar download opens, is recognisably the ancestor of the one a Mac still shows before a downloaded program first runs. Defacement waves went on following political quarrels, as Lithuania's did in June 2008, and a defaced page went on meaning what Preatoni said it did: someone had the access to do worse. The Reserve Bank, for its part, has been warning about the fraud it named that February ever since.