5/19/03 Worm Alert: Don't Open E-Mail from support@microsoft.com
"Your Password" -- To Trouble
by Eric Grevstad

A new virus infection has been spreading rapidly since last weekend, luring gullible e-mail users to execute an attachment to a bogus e-mail message from support@microsoft.com.

The subject line of the message may read "Your Password," "Your details," "Approved (Ref: 38446-263)," "Screensaver," or a "Re:" variation on the above. The message body reads only, "All information is in attached file."

The attached file is the Palyh worm, which -- like last week's fast-spreading Fizzer or the Sobig virus of several months ago -- copies itself to the Windows directory, Registry, and Startup folder and begins looking for open network connections and sending itself to every e-mail address it can find on the infected PC. Antivirus vendors say the worm will stop propagating after May 31.
5/19/03 Worm Alert: Don't Open E-Mail from support@microsoft.com