'My Party' worm tricks users into infecting themselves

January 29, 2002

A worm that tricks victims by masquerading as a Web page link with party photos infected thousands of computers around the world Monday.

The virus arrives as an email with the subject line "new photos from my party!" and and an attachment named "www.myphotos.yahoo.com".

A message in the body of the email reads: "Hello! My party... It was absolutely amazing! I have attached my web page with new photos! If you can please make color prints of my photos. Thanks!"

The attached link to "www.myphotos.yahoo.com" in fact is an executable file. Upon clicking the link, the malicious agent infects the computer. After the computer is infected, the worm sends itself to all addresses in the user's copy of Microsoft Outlook, Outlook Express, or in his Windows Address Book. Computers running Windows NT, 2000, or XP are also infected with a backdoor, which can enable the creater of 'My Party' to remotely control the victim's PC.

Antivirus companies Symantec, Trend Micro, and McAffee have all rated the worm a "medium" threat. Patches to remove or inoculate your system against the bug are available for download.

The unique tactic used by the worm has contributed to its successful infection rate. Many users were infected just because the e-mail arrives from a friend or colleague.

The worm is currently rated a "medium" threat by most antivirus firms. And although it is still spreading, it appears not to be reaching outbreak status like the LoveBug or Nimda worm.

Most antivirus vendors have already issued patches to remove the worm from infected systems.