Worm Masquerades As Microsoft Support Message

Dubbed Palyh, the mass-mailing worm can arrive as an e-mail from [email protected] and comes with various subject lines, messages and file attachments.

When the file is executed, the worm uses the victim system's e-mail address book to spread, searches for HTML pages and text documents for other addresses, and also appears to spread via file shares, according to Message Labs, a provider of managed e-mail security services.

MessageLabs said it intercepted more than 35,000 copies of Palyh in 89 countries, with a majority reported in the U.K. The company expected the worm to hit the United States hard Monday as people came to work.

Due to an increased number of submissions, Symantec upgraded the worm from a category two to a category three rating, with five being the most serious. Symantec said it received reports of the worm from 221 consumers and six businesses.

Systems affected by Palyh include Windows 95, 98, NT, 2000, XP and ME, according to Symantec.

The worm has the ability to install spyware programs on infected systems, Kaspersky Labs said. The author of Palyh, however, included a temporary trigger in the worm so that its routines are active only until May 31, the company said.