Win32/MyLife.G Worm

 Information about the Win32/MyLife.G worm:

Win32/MyLife.G is an email worm. This worm will infect Windows systems. It spreads using the email addresses present in Microsoft Outlook address book and MSN messenger contact list.

It arrives with the following subject:

ox <--> sharon

The body of the mail contains:

Hi All,
look to the ox caricature it's very sad
ox <===> sharon
it's funny :-)
bye

Attachments are automatically scanned for viruses using MCAFEE.COM

========No Viruse Found========


This mail contains an attachment Wife.scr. Upon execution of the attachment, it displays a image with the title SHARON. The worm copies itself to Windows System directory as ox&Wife.scr. After this the worm uses Microsoft Outlook address book and MSN messenger contact list to propagate itself.

The worm makes necessary changes to registry at the following location to load itself at next system startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run

When a worm file ox&Wife.scr present in Windows System folder is executed, it deletes all files and folders in C: drive. It also has a payload to format D:, E:, F:, G:, H:, I: drives. After this it displays a message box with the title KiLlLlLl aNd KiLlLlLl with the following contents:

KiLlLlLl sHaRoN bY:
mY lifE
1. oVeR wRiTe 30 <--> eXtEnSiOn
2. dElEte aLl fOlDeRs (C to l)
3. LoOOoOOoL

This worm first appeared on 10th April 2002.

 Other names of Win32/MyLife.G worm:

This worm is also known as W32/MyLife.G, Worm_MyLife.G.