MyLife .B Worm Deletes Infected PCs Files

 
 
By Dennis Fisher  |  Posted 2002-03-22 Print this article Print
 
 
 
 
 
 
 

MyLife.B, a new worm that has the ability to delete files from infected machines, arrives via e-mail and is a variant of the original MyLife virus.

Anti-virus experts are tracking a new worm that has the ability to delete files from infected machines. The worm, known as MyLife.B, arrives via e-mail and is a variant of the original MyLife virus, which has been in the wild for some time. The worm arrives in an e-mail with the subject line of "bill caricature" and the following body text:
    "Hiiiii
    how are youuuuuuuu?
    look to bill caricature its vvvery ffffunny :-) :-)
    i promise you will love it? Ok
    buy"
The message also contains the line, "No Viruse (sic) Found, McAfee.com," an apparent attempt to make unsuspecting users believe that the message has been scanned and found to be clean.
The worm mails copies of itself to all of the names in the infected computers Microsoft Outlook address book, but also carries a destructive payload. As part of the infection process, MyLife creates a registry run key that activates the worm during each bootup of the machine. If the machine boots between 8 a.m. and 9 a.m., the worm deletes files from the PCs C, D, E and F drives as well as in the system directory, according to Craig Schmugar, a virus researcher with Network Associates Inc.s AVERT team. The worms attachment is a screen saver file with name "Cari.scr," which displays an image of Bill Clinton. Many corporate network administrators block .scr files at the Internet gateway, Schmugar said, which should prevent this variant from spreading widely. MyLife was first spotted Thursday in several European countries and is classified by McAfee.com as a medium risk. Related stories:
  • Microsoft Warns of JVM Vulnerability
  • Anti-virus Makers Pushing Automation
  •  
     
     
     
     
     
     
     
     
     
     

    Submit a Comment

    Loading Comments...
     
    Manage your Newsletters: Login   Register My Newsletters























     
     
     
     
     
     
     
     
     
     
     
    Rocket Fuel