Palyh-A - the email virus that is NOT from Microsoft

By Alun Williams

Posted on 19 May 2003 at 11:46

Another week another worm. Sophos is warning of a new threat to your PC - Palyh-A (alias Mankx), which purports to be sent from Microsoft.com. It is another worm that simply spreads itself by email, having extracted email addresses from various files on your computer, such as .WAB (Windows Address Book), .html and .txt files.

Appearing to arrive from support@microsoft.com, it has a variety of subject lines and names for the attachment. Whatever its guise, however, the infected executable file msccn32.exe is copied to your Windows folder. Note that Microsoft never distributes executables by email, so this is a clear indication the email is bogus.

As with previous email worms - such as Bugbear - it does not rely on Outlook Express being present to spread itself by email. The worm brings its own SMTP (simple mail transfer protocol) engine to do the work.

More information about the virus and a Sophos virus identity file (IDE) is available here.