W32.myparty worm

January 28, 2002

The W32.myparty worm hit Virginia Tech over the January 26-January 27, 2002 weekend arriving via e-mail with the subject line 'new photos from my party!'. The e-mail contains the attachment 'www.myparty.yahoo.com' that, although it looks like a URL, is actually a file. If you click on the file, your infected Microsoft Windows computer will attempt to send out copies of the worm to addresses listed in your Address Book and e-mail addresses found in mail messages on your computer. The latest virus definitions for Norton AntiVirus will detect the virus and will remove any infected files on your computer.

For more information on this virus:
http://www.sarc.com/avcenter/venc/data/w32.myparty@mm.htmlExternal Link

For removal instructions:

  1. Download and install the latest Norton AntiVirus LiveUpdate.
  2. Run a full scan of your system.

Note: If you get a message telling you that Norton was unable to clean the file and are asked if you wish to quarantine it, select 'Yes'. This message just means that Norton cannot fix the file and is removing it from your system to prevent problems.

Note: If you are a Windows ME user and are having problems running a virus scan, please read the following:
Because Windows ME has a System Restore feature, it may "backup" some of the virus infected files. NAV will detect these files, but it can't delete or quarantine them. You'll notice in the scan window that they're located in 'C:\_Restore'. To fix this problem, you just need to disable System Restore and then rescan the computer. To do this:

  1. Right click on 'My Computer'.
  2. Select 'Properties' from the pop-up menu.
  3. Select the 'Performance' tab in the 'System Properties' window.
  4. Click 'File System...'.
  5. Select the 'Troubleshooting' tab.
  6. Place a check in the box next to 'Disable System Restore'.
  7. Click 'OK'.
  8. Click 'Close'.
  9. Click 'Yes' to restart the computer.