F-Secure Virus Descriptions : Myparty

    Subject:    new photos from my party!

    Body:       Hello!

                My party... It was absolutely amazing!
                I have attached my web page with new photos!
                If you can please make color prints of my photos. Thanks!

    Attachment: www.myparty.yahoo.com

Please note that the attachment may look like a link to a web site in some email clients.

The worm is a PE EXE file about 30kb long, compressed with a modified UPX file compressor. The origin of the worm is most likely Russia. The worm behaves a bit differently on NT and 9x-based systems. On non-Russian NT-based systems the worm drops a backdoor that is controlled by a script on a remote website.

When the worm's file is activated it first checks system date. If the year is 2002, months is January and date is earlier than 25th, the worm tries to copy itself to \Recycled or \Recycler folder and terminates its process. If the date is between 25th and 29th, the worm doesn't perform this operation and continues working.

Then the worm checks keyboard layouts and if one of the layouts is equal to 0419 (Russian), the worm copies itself to Recycled Bin and terminates its process. So systems with Russian keyboard layout are not vulnerable.

On non-Russian NT-based systems the worm drops a backdoor to current user's profile startup folder (\Start Menu\Programs\Startup) as MSSTASK.EXE. This file will be activated on next Windows startup and also after the worm sends itself out. The dropped file is a backdoor that is controlled by a CGI script a website with address '209.151.250.170'.

The worm checks the name of file from which it was started. If the operating system is Windows 9x, the worm copies itself to Recycled Bin as REGCTRL.EXE, otherwise if operating system is NT-based, the worm copies itself to root of C: drive as REGCTRL.EXE. After that the worm opens a default web browser on 'www.disney.com' page and starts the REGCTRL.EXE file from the location it was copied to earlier. The original file that the worm was started from is attempted to be moved to Recycle Bin with a randomly generated name, but this does not happen on Windows 9x systems.

When the worm is started from a *.COM file, it only copirs its file as REGCTRL.EXE to either \Recycled or root folder of C:\ drive, activates this file and moves the original file that it was started from to Recycled Bin.

If the worm is started from EXE file, it gets user's SMTP server address and e-mail address from the Registry. Also the worm locates Windows Address book and gets e-mail addresses from there. After that worm browses *.DBX files (Outlook e-mail databases) for e-mail addresses. Finally the worm sends itself to all found e-mail addresses. The worm also sends a message to 'napster@gala.net' e-mail address.

After mass-mailing the worm moves its file to Recycled Bin and activates a backdoor if it was previously dropped to Startup folder of current user's profile.

Here's what the message and attachment looks like under Outlook Express:

Here's what the message and attachment looks like under Outlook 2000:

Here's what the message and attachment looks like under Outlook XP:

Here's what the message and attachment looks like under Netscape 4.61:

Here's what the message and attachment looks like under Netscape 6.21:

Here's what the message and attachment looks like under Eudora 5:

Detection of the worm has been added to F-Secure Anti-Virus in the update shipped on January 28, 2002 / 11:30:44 (GMT+2).

Disinfection Instructions

If you have Windows 9x-based system, restart your computer first. Then scan all your hard drives and delete all found samples of Myparty worm. Use 'Ask after scan' as the default action for F-Secure Anti-Virus and then select 'Delete' action for worm files. Important: do not select 'Delete' disinfection action if an infection is reported in e-mail database!

If you have NT-based system, open Task Manager, Click on 'Processes' tab, find 'msstask.exe' process, select it by clicking on its name and then click 'End Process' button. Important: do not terminate 'mstask.exe' process! After that locate MSSTASK.EXE file on your hard drive (it should be in your user profile \Start Menu\Programs\Startup folder) and delete it. You can use 'Find Files and Folders' functionality of Windows to search for 'MSSTASK.EXE' file.

VARIANT:

Myparty.b

This version was found later on January 28th, 2002 - but it seems to predate the version described above. This version was programmed to spread during January 20-24th, 2002.

[Analysis: A. Podrezov, S. Rautiainen, V-J Kesti, M. Hyppönen: F-Secure Corp; January 28th, 2002]