The "Myparty" virus is one of those common "mass-mailing" type viruses which send itself to everyone in your address book. None of the info I've read on this virus indicates that it interferes with opening other attachments. It's a new virus though, so maybe all its effects haven't been documented yet.
You can tell if you've been infected by the following indicators:
Presence of C:\RECYCLED\REGCTRL.EXE (visible from a DOS prompt, not from within Windows)
Presence of C:\REGCTRL.EXE
Presence of %userprofile%\Start Menu\Programs\Startup\msstask.exe
If those are there, you should obtain the latest DAT file for your anti-virus program (well, you should have that in any case) and then run a full system scan. And you should delete the above-mentioned files.
Here is more complete info from Norton A-V's site.
W32.Myparty@mm arrives as an email with the following characteristics:
Subject: new photos from my party!
My party... It was absolutely amazing!
I have attached my web page with new photos!
If you can please make color prints of my photos. Thanks!
When it is executed, the worm first checks the date. If the computer date is not between January 25 to 29, 2002 or if the keyboard settings are set to Russian, the worm copies itself to:
C:\Recycled-F-<random digits>-<random digits>-<random digits>
Otherwise, the worm continues.
The worm next checks its own file name, and performs different actions depending on the file name or extension:
If the file name is "Access" the worm attempts to launch your Web browser to http:/ /www.disney.com and exits. However, the worm does not contain code which can generate a file with the name Access.<any extension>, so it is highly unlikely that this will trigger.
If the file name has a .com extension, the worm copies itself to one of the following locations:
C:\Regctrl.exe (Windows NT/2000/XP)
C:\Recycled\Regctrl.exe (Windows 95/98/Me).
and then executes the Regctrl.exe file.
If the file name has a .exe extension such as Regctrl.exe, the worm begins its propagation routine:
1. The worm searches the Windows address book that is used by Microsoft Outlook and Outlook Express, and through files with the extension .dbx in the Microsoft Outlook Express folder for email addresses. (The .dbx files are Microsoft Outlook Express folders and inboxes.)
2. The worm sends itself to these email addresses using its own SMTP engine. The worm uses the default SMTP server address that is configured on the computer. The From: address is set to your email address.
3. On Windows NT/2000/XP computers the worm creates a backdoor Trojan:
so that it is executed when you start Windows. This backdoor trojan contacts a Webpage at 126.96.36.199 which allows the author to have access to the computer. Depending on the contents of the Webpage, the backdoor will perform different actions.
Finally, the worm sends a message to [log in to unmask], allowing the author to track how far the worm has spread.
1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. Delete all files that are detected as W32.Myparty@mm or Backdoor.Myparty.
District Technology Coordinator
Montpelier Public Schools
58 Barre Street
Montpelier, VT 05602
Voice: (802) 229-5355
Fax: (802) 223-6146
Email: [log in to unmask]
>>> [log in to unmask] 01/29/02 05:52AM >>>
Thanks, Phil. Unfortunately, I opened this message late yesterday afternoon
at school. I didn't notice any problem until today when I am having trouble
receiving attachments. I logged onto the website below but there are no
instructions as to what to do. I did not open the photo and have discarded
the message. Can you tell me what to do?
Mettawee Community School
RR 1, Box 415
West Pawlet, Vermont 05775