Win32/MyLife.F Worm

 Information about the Win32/MyLife.F worm:

Win32/MyLife.F is an email worm. It is a variant of Win32/MyLife.C. This worm will infect Windows systems. It spreads using the email addresses present in Microsoft Outlook address book and MSN messenger contact list.

It arrives with the following subject:

the list

The body of the mail contains:

Hiiiii
How are youuuuuuuu?
look to the notepad it's vvvery verrrry ffffunny :-) :-)
i promise you will love it :-)
Notepad = list
list = 37
buyyyy

========No Viruse Found========

                 MCAFEE.COM
----------------------------------------------------------

This mail contains an attachment List480.TXT.scr. Upon execution of the attachment, it displays a message box with the title Error and the message text Error Notepad.dll ##.
The worm copies itself to Windows System directory as List480.TXT.scr. After this the worm uses Microsoft Outlook address book and MSN messenger contact list to propagate itself.

The worm makes necessary changes to registry at the following location to load itself at next system startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

During next startup, the worm deletes all files and folders in C: drive. It also has a payload to format D:, E:, F:, G:, H:, I: drives.

This worm first appeared on 31st March 2002.

 Other names of Win32/MyLife.F worm:

This worm is also known as W32/MyLife.F, Worm_MyLife.F.