PDA

View Full Version : Virus Alert! - W32/Palyh@MM



ajx22
May 23rd, 2003, 05:41 AM
Do not open any file attachments within Email messages purporting to come from support@microsoft.com

You may receive an Email message that appears to come from Microsoft Support. This Email message contains an infected attachment. The name of the virus is W32/Palyh@MM. It disguises itself as a screen saver file or other attachment type. If the attachment is opened, the virus can potentially make copies of itself and send itself (without your knowledge) to everyone in your Email program’s address book.

This virus is particularly insidious as it purports to be from Microsoft Support (support@microsoft.com), a trusted company that the majority of Internet customers are aware of and have done business with.

Additionally, although unconfirmed, the virus can have potentially serious impacts on your computer’s files and can affect the performance of your computer.

IF YOU RECEIVE THIS EMAIL MESSAGE, DO NOT OPEN THE ATTACHMENT. DELETE THE EMAIL IMMEDIATELY.

Microsoft is aware of this fraudulent Email message and has issued the following statements available from Microsoft.com:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/virus/alerts/palyh.asp


Following are details on the Email message containing the virus:

To: This message has been sent to numerous Email users all over the Internet

Date Sent: (Varies)

From: support@microsoft.com (NOTE: This Email IS NOT being sent by Microsoft, the Email address is a fraudulent address that only appears to be coming from Microsoft)

Subject: May contain one of the following subject lines (but not limited to):


Re: My application
Re: Movie
Cool screensaver
Screensavers
Re: My details
Your password
Re: Approved (Ref: 3394-65467)
Approved (Ref: 38446-263)
Your details


Body of the Email Message:
"All information is in the attached file."

Attachment Name:
The infected attachment file may be one of the following names (but not limited to):


approved.pif
ref-394755.pif
password.pif
ref-394755.pif
application.pif
screen_doc.pif
screen_temp.pif
movie28.pif
download1053122425102485703.uue
doc_details.pif
_approved.pif


Details:


The message will appear to come from Microsoft Support (or from someone who has you listed in their address book).
The virus will not infect your computer unless you have opened the attachment.






~ Steps for cleaning the W32/Palyh@MM Virus ~

IF YOU HAVE OPENED THE INFECTED ATTACHMENT:


1. If you do not already own one, download an updated Anti-Virus software package. These virus-scanning packages can be downloaded from:


Norton Antivirus (Download Norton AntiVirus 2003 Trial Version!!! (http://www.aquariumpros.ca/download.php?op=getit&lid=5))


NOTE: Even if you own a virus scanning software package, it is very important that you download the latest virus definition file so that your software can clean this new virus.

2. Run your virus scanning software which will detect the W32/Palyh@MM and offer to clean it from your system. Select the option that cleans it from your system.

3. Read through the steps in the Surf Safe section on Rogers customer support site to keep your computer safe. The Surf Safe section can be found at: http://rogers.home.com/help/content/how/surf_safe/




IF YOU HAVE RECEIVED THE EMAIL, BUT HAVE NOT OPENED THE INFECTED ATTACHMENT:

1. Delete the Email Message.

2. Empty your deleted Email folder.

3. Update your existing Anti-Virus Software or purchase one from the site listed above.

4. Read through the steps in the Surf Safe section on Rogers customer support site to keep your computer safe. The Surf Safe section can be found at: http://rogers.home.com/help/content/how/surf_safe/

It is strongly recommend that you consistently scan your Email attachments and downloaded files to protect your personal computer, no matter how trusted the source. This advice applies to all Email messages, not just the one discussed in this message.


Please help keep the internet safe and fun for everyone - Just like you must have insurance to drive a car - you MUST have an up-to-date Anti-Virus program on your computer if it accesses the Internet!!

Thank you,

kasia
May 23rd, 2003, 09:38 AM
I keep getting this virus everyday so far for the past week!!

ajx22
June 2nd, 2003, 04:47 PM
Do not open ANY Email attachments that have names ending in .pif or .scr

UPDATE June 2nd 2003 - 2:15 PM
The 'FROM' Email address previously appeared to come from bill@microsoft.com. However, it now may appear to come from
ANYONE who has your Email address in their contacts or address book. Currently, the only defining feature of this Email message is that the infected attachment file ends with either a .scr or .pif. Please see the details below for more information.

UPDATE June 2nd 2003 - 2:30 PM
Symantec Security Response has released a standalone tool which can remove this virus from your computer.
The tool is available on Symantec’s Website. (http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.c.removal.tool.html)

You may receive an Email message with an infected attachment. The name of the virus is W32/Sobig@MM. The virus disguises itself as a screen saver file or other attachment type (generally ending with .scr or .pif. If the attachment is opened, the virus can potentially make copies of itself and send itself (without your knowledge) to everyone in your Email program’s address book.

A few of the infected Email messages appear to be coming from bill@microsoft.com. Please be aware that this Email message IS NOT coming from Microsoft. The virus can forge the ‘From’ Email account to make it appear that it is coming from Microsoft.

IF YOU RECEIVE THIS EMAIL MESSAGE, DO NOT OPEN THE ATTACHMENT. DELETE THE EMAIL IMMEDIATELY.

Following are details on the Email message containing the virus:

To: This message has been sent to numerous Email users all over the Internet

Date Sent: (Varies)

From: Varies, usually someone who has you in their email address book.
Occasionally from bill@microsoft.com

FROM NOTES:


This Email IS NOT being sent by Microsoft, the Email address is a fraudulent address that only appears to be coming from Microsoft
The virus HAS mutated making it appear to come from someone who has your email address in their contact list or email address book.


Subject: May contain one of the following subject lines (but not limited to):


Re: Movie
Re: Submited (004756-3463)
Re: 45443-343556
Re: Approved
Approved
Re: Your application
Re: Application


Body of the Email Message:

The body of the Email message states:
“Please see the attached file.”

Attachment Name: The infected attachment file may be one of the following names (but not limited to):


screensaver.scr
movie.pif
submited.pif
45443.pif
documents.pif
approved.pif
application.pif
document.pif


File Size of the Attachment: Approximately 59KB (may vary)

Details:


The message will appear to come from someone who has you listed in their address book (occasionally appears to come from bill@microsoft.com).
The virus will not infect your computer unless you have opened the attachment.


Steps for cleaning the W32/Sobig.c@MM Virus

IF YOU HAVE OPENED THE INFECTED ATTACHMENT:

1. If you do not already own one, download an updated Anti-Virus software package. These virus-scanning packages can be downloaded from:


Norton Antivirus (http http://www.symantec.com/downloads/ (http://www.symantec.com/downloads/))

NOTE: Even if you own a virus scanning software package, it is very important that you download the latest virus definition file so that your software can clean this new virus.

2. Run your virus scanning software which will detect the W32/Sobig.c@MM Virus and offer to clean it from your system. Select the option that cleans it from your system.

UPDATE: Symantec Security Response has released a stand-alone tool which can remove the virus from your computer if you do not have an Anti-Virus Software package installed. The tool is available on Symantec’s Website. (http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.c.removal.tool.html)

IF YOU HAVE RECEIVED THE EMAIL, BUT HAVE NOT OPENED THE INFECTED ATTACHMENT:

1. Delete the Email Message.

2. Empty your deleted Email folder.

3. Update your existing Anti-Virus Software or purchase one of the packages listed above.

It is strongly recommended that you consistently scan your Email attachments and downloaded files to protect your personal computer, no matter how trusted the source. This advice applies to all Email messages, not just the one discussed in this message.