New Worm Cloaked in Microsoft Disguise

Beware a new worm in Microsoft clothing.

A new worm is rapidly spreading across the globe, disguised as an email from Microsoft’s technical support department. The worm, known as W32/Palyh or Mankx, is ranked under the highest alert levels because it downloads malicious code from a remote Web site and because it has spread quickly in less than a day, indicating a quick strike seeding in the wild.

The email carries an attachment and a note saying that all information is in the attached file. The attachment is a Windows program with a PIF extension. If users open the attachment, their computers are infected immediately.

The worm copies itself to the Windows folder and uses email addresses stored on the user’s hard disk to send itself back out.

”Many users who are wary of EXE and VBS files which arrive in their email may not realize that PIF files are equally capable of being malicious,” says Graham Cluley, a senior technology consultant for Sophos Anti-Virus. ”Microsoft technical support does not send out files in this way, and users should think twice before they click.”

MessageLabs, an anti-virus vendor, notes that Palyh, which reportedly originated in the Netherlands, was first detected on May 17, and has quickly spread to 69 countries. China, the United States and the United Kingdom seem to be the hardest hit at this point.

Ken Dunham, a senior malicious code intelligence manager at iDefense, Inc., an antivirus company, suggests that administrators temporarily implement filters against PIF, PI, and UUE email attachments until the outbreak is over.

Sophos recommends blocking all Windows programs at the email gateway.

”Best practices for business should include automatic blocking of all executable code at the email gateway,” says Sophos’ Cluley. ”At the very least, all PIF files should be blocked. There should never be any need to distribute genuine PIF files — which are really just a type of shortcut — via email.”