New Worm Cloaked in Microsoft Disguise
A new worm is rapidly spreading across the globe, disguised as an email from Microsoft's technical support department.
A new worm is rapidly spreading across the globe, disguised as an email from Microsoft's technical support department. The worm, known as W32/Palyh or Mankx, is ranked under the highest alert levels because it downloads malicious code from a remote Web site and because it has spread quickly in less than a day, indicating a quick strike seeding in the wild.
The email carries an attachment and a note saying that all information is in the attached file. The attachment is a Windows program with a PIF extension. If users open the attachment, their computers are infected immediately.
The worm copies itself to the Windows folder and uses email addresses stored on the user's hard disk to send itself back out.
MessageLabs, an anti-virus vendor, notes that Palyh, which reportedly originated in the Netherlands, was first detected on May 17, and has quickly spread to 69 countries. China, the United States and the United Kingdom seem to be the hardest hit at this point.
Ken Dunham, a senior malicious code intelligence manager at iDefense, Inc., an antivirus company, suggests that administrators temporarily implement filters against PIF, PI, and UUE email attachments until the outbreak is over.
Sophos recommends blocking all Windows programs at the email gateway.
''Best practices for business should include automatic blocking of all executable code at the email gateway,'' says Sophos' Cluley. ''At the very least, all PIF files should be blocked. There should never be any need to distribute genuine PIF files -- which are really just a type of shortcut -- via email.''
By Paul Desmond
May 12, 2003
A recent META Group study underscores what many of us already knew: email is now a more important business communications tool than the telephone. If that's the case, then email security must be an increasingly important priority.