Oslo, 28 January 2002  

Norman ASA a world leader in the field of antivirus software today warns against a new fast spreading e-mail worm with the name MyParty.

This is a worm that spreads through e-mail and sends itself to addresses in the Windows address book. The analysis so far has not shown the worm to be destructive, but it might cause some problems by creating a lot of traffic because of the tempting subject, body text and attachment. The attachment name resembles a web page URL, however the file is really a Win32 executable.

The full name of the worm is: W32/MyParty.A@mm

General characteristics

  • Type: Worm
  • Spreading mechanism: Email
  • Email characteristics:
    • Subject: new photos from my party!
    • Body: Hello! My party... It was absolutely amazing! I have attached my web page with new photos! If you can please make color prints of my photos. Thanks!
    • Attachment: www.myparty.yahoo.com
    • Destructivity: None

Additional description of malicious program

Type

'This is an email worm that sends itself to addresses in the Windows Address Book.

Spreading mechanism

The attachment name resembles a web page URL, however the file is really a Win32 executable. The file is compressed with the compression utility UPX.

When executed it will copy itself to the RECYCLED folder and attempt to send itself to users found in the Windows Address Book and addresses found in DBX files (mail database files used by f.ex. Outlook Express).

Norman Virus Control with definitions files from January 28th. 2002 or later detects this worm. Users are encouraged to update their Norman Virus Control protection to the most recent version.

For detailed Information about this threat visit: www.norman.com

For further information, please contact

Norman ASA, VP Marketing Bjørn A. Windfeldt, tel.+47 67 10 97 76, mob. +47 41 53 97 76