Posted on 22-5-2003

Worm (Virus) Uses Fake Microsoft Address
By Matt Loney, Special to CNET News.com, May 19, 2003, 7:21 AM PT

A new mass-mailing e-mail worm, which feigns a Microsoft.com origin, is
spreading rapidly. Antivirus vendors say it can also spread via a local
area network and can install "spyware" on a victim's PC.

The Palyh, or Mankx, worm appears to come from support@microsoft.com, a
forged address. It contains a file which, upon execution, self-propagates
using e-mail addresses from files stored on the targeted system, but which
can also spread to other Windows machines on a local area network (LAN).
Although the file has a .pi or .pif extension, it is an .exe file. And
because Windows processes files according to their internal structure
rather than their extension, Windows runs the file as soon as the recipient
double-clicks on it....

The most effective long-term solution against these viruses is to change
email programme from Microsoft Outlook to something else - like Eudora or
Pegasus.