"Badparty-A" trojan warning

[Paul Adams]

Sophos write-up on "Badparty-A" trojan

I get stacks of updates daily from Sophos on new worms etc, but this one I thought worth mentioning here due to its payload:

Troj/Badparty-A displays a message box containing the text 'Press OK to install the party invitation...'.
When the user clicks on OK the Trojan deletes the partition table in the master boot sector and the contents of the FAT. The Trojan then attempts to create a new partition table.

The Trojan creates the following files, which are all copies of legitimate utilities:
ginst0.dll in the Windows temp folder
int86_16.dll, int86_32.dll, playme.exe and party.ini in the Windows folder

Given that there's only been 1 report so far, and it doesn't mention any propagation method, it's not likely to cause widespread damage, but it does look a little nasty if someone were to receive and execute it.

[Steve]

It says it deletes the FAT, but what about the MFT on NTFS drives?

[Atomic]

It says it deletes the FAT, but what about the MFT on NTFS drives?

Is it even possible to do that within Windows?

[Steve]

It is, partiton magic can do it, norton ghost and acronis true image write to the MBR from windows too.