PRESS RELEASE  
Oslo, 19 May 2003  

The data security company Norman ASA warns against the network worm Palyh. It sends itself to email addresses it finds in various sources on the infected user's machine. In addition, it enumerates network shares and copies itself to other machines on the local network.

The worm is very similar to W32/Sobig.A, rated at high risk by Norman on January 10th this year. In addition the worm attempts to download and execute certain files from web accounts hosted on the site www.Geocities.com. The worm employs a large variety of different subject lines, body texts and attachment names, full details of which can be found at www.norman.com.

Norman Virus Control (NVC) with definitions files from May 19th 2003 or later detects all known variants of the worm. Users are encouraged to update their NVC installation with the recent definition files immediately.

More information on www.norman.com

For further information, please contact

Norman ASA, Audun Lødemel, tel.+47 671 097 79 / +47 934 465 31