support@microsoft.com is a Worm

[Website Rob]

For those (like myself) that have been wondering about the returned eMails or the ones sitting in the Mail queue with that return address, I have found out it is the result of a new Worm.


Alias: I-Worm.Palyh (Kaspersky),
W32.HLLW.Mankx@mm (Symantec),
W32/Palyh@MM (McAfee),
Win32/Palyh.A.Worm
Category: Win32
Type: Worm
Last Modified: 5/18/2003


CHARACTERISTICS
Win32.Palyh.A is a worm which spreads via e-mail using its own SMTP engine, and through shared drives.

The only message body observed at this time contains simply:

All information is in the attached file.

The worm also spoofs the 'From' address. E-mail sent by the worm appears to be from the following address:

"support@microsoft.com"


Although there is not much we can do, it's always nice to know 'why' something is happening.

cPanel.net Support Ticket Number:

[sexy_guy]

We run Mailscanner with Rav so we dont worry about it. Everthing is neatly filed in the quarentine queue and then deleted after a few days after the user gets their warning email.

cPanel.net Support Ticket Number: