Hi Folks,
>> Does anyone know what this program is supposed to do? Is this a
>> new virus?
> It's the Win32.Party virus. Not quite a week old in the wild, I believe.
It was released on the 24th January, and re-released on the 28th in a
slightly different form.
It is a worm, propagates itself through (wouldn't ya know it ! )
Outlook, with its own built-in SMPT code, and it also drops a trojan
back-door (RAT - Remote Access Trojan) for its author, a Russian.
It targets Win9.x and WinNT systems. Machines with Russian keyboard
lay-outs are immune.
This is apparently the first time that a worm/virus has tried to have
its attachment link mimic a URL, and sucker the unwary into clicking on
it.
I had it checked out with two anti-virus centres.
Quote from VET:------
The analysis of the file submitted as "www.myparty.yahoo.com"
has been completed.
The Windows Portable Executable file has been determined to be malicious.
An Antivirus researcher has analysed the file and confirmed the findings.
The file has been identified as Win32.MyParty.A worm.
Similar names (alias) reported by other products are listed here:
(Win32/Myparty.Worm)(Win32/Myparty.A)(W32/Myparty.A@mm)(I-Worm.Myparty.a)(W32/Myparty.a@MM)(W32.Myparty@mm)(WORM_MYPARTY.A)
This piece of malware is detected by VET Antivirus.
Make sure you are using the latest update:
Engine MajorDat MinorDat MacroDefDate Updated:
5.4.1.2 1000 1801 Jan 29 2002 30 Jan
This update will automatically delete the malicious files as no recovery
is possible.
This signature version has been released. We suggest you use the "AutoDownload"
feature of the product to install it.
Researcher comment:
This is a new mass-mailing worm called W32/MyParty.
End Quote:----
So I can confirm that it is now detected with the latest virus
signature updates from both VET, and F-PROT, both of which I use, and
probably everyone else by now.
So get the latest virus signatures for your favourite anti-virus
software, and you should be OK again.
Regards,
Ron
Ron Clarke
http://homepages.valylink.net.au/~ausreg/index.html
http://homepages.valylink.net.au/~ausreg/music.html
-- This mail was written by user of Arachne, the Versatile Internet Client
To unsubscribe from SURVPC send a message to [EMAIL PROTECTED] with
unsubscribe SURVPC in the body of the message.
Also, trim this footer from any quoted replies.
More info can be found at;
http://www.softcon.com/archives/SURVPC.html
