N/A - KB904420

Microsoft wants to make customers aware of the Mywife mass mailing malware variant named Win32/Mywife.E@mm. The mass mailing malware tries to entice users through social engineering efforts into opening an attached file in an e-mail message. If the recipient opens the file, the malware sends itself to all the contacts that are contained in the system’s address book. The malware may also spread over writeable network shares on systems that have blank administrator passwords.

Customers using Windows XP Service Pack 1, Windows XP Service Pack 2, Windows Server 2003, or Windows Server 2003 Service Pack 1 may be at reduced risk from this malware; if the account password is blank, the account is not valid as a network credential. In an environment where you can guarantee physical security, you do not need to use the account across the network, and you are using Windows XP or Windows Server 2003, a blank password is better than a weak password. By default, blank passwords can only be used locally in Windows XP and Windows Server 2003.

Customers who are using the most recent and updated antivirus software could be at a reduced risk of infection from the Win32/Mywife.E@mm malware. Customers should verify this with their antivirus vendor. Antivirus vendors have assigned different names to this malware but the Common Malware Enumeration (CME) group has assigned it ID CME-24.

On systems that are infected by Win32/Mywife@E.mm, the malware is intended to permanently corrupt a number of common document format files on the third day of every month. February 3, 2006 is the first time this malware is expected to permanently corrupt the content of specific document format files. The malware also modifies or deletes files and registry keys associated with certain computer security-related applications. This prevents these applications from running when Windows starts. For more information, see the Microsoft Virus Encyclopedia.

As with all currently known variants of the Mywife malware, this variant does not make use of a security vulnerability, but is dependent on the user opening an infected file attachment. The malware also attempts to scan the network looking for systems it can connect to and infect. It does this in the context of the user. If it fails to connect to one of these systems, it tries again by logging on with "Administrator" as the user name together with a blank password.

Customers who believe that they are infected with the Mywife malware, or who are not sure whether they are infected, should contact their antivirus vendor. Alternatively, Windows Live Safety Center Beta Web site provides the ability to choose “Protection Scan” to ensure that systems are free of infection. Additionally, the Windows OneCare Live Beta, which is available for English language systems, provides detection for and protection against the Mywife malware and its known variants.

For more information about the Mywife malware, to help determine whether you have been infected by the malware, and for instructions on how to repair your system if you have been infected, see the Microsoft Virus Encyclopedia. For Microsoft Virus Encyclopedia references, see the “Overview” section. We continue to encourage customers to use caution with unknown file attachments and to follow our Protect Your PC guidance of enabling a firewall, getting software updates, and installing antivirus software. Customers can learn more about these steps by visiting the Protect Your PC Web site.

What is the scope of the advisory?
To make customers aware of the Mywife malware that affects Windows-based computers and to describe steps they can take to help prevent and remediate possible infection.

Is this a security vulnerability that requires Microsoft to issue a security update?
No. This is not a security vulnerability. This advisory is being issued to provide additional information for users who could be infected by the Mywife malware.

What is the potential damage?

On the third day of every month, beginning Friday February 3, this variant of the malware resets the content of files that have specific file name extensions. It searches for files on the hard disk that have the following file name extensions and replaces their contents with "DATA Error [47 0F 94 93 F4 K5]":

.doc

.xls

.mdb

.mde

.ppt

.pps

.zip

.rar

.pdf

.psd

.dmp

For more information, see the Microsoft Virus Encyclopedia.

Some sources indicate that millions of computers are infected. How does Microsoft scope the infection?

Our analysis has determined that the Web counter is being artificially manipulated. The data the Web counter references is not a trustworthy indication of infection rate or of the total of infected computers. Instead, we use our industry partnerships and our own internal data to help gauge the impact to customers. This information has revealed that the attack is much more limited and is not in the range of millions at this time.

Will my antivirus software help protect me from exploitation of this malware?
The following members of the Virus Information Alliance have indicated that their antivirus software helps provide protection from exploitation of the Mywife malware.

Aladdin

Computer Associates

F-Secure

Kaspersky

McAfee

Norman

Panda

Symantec

Trend Micro

ESET

Sophos