W32/MyLife.M Worm

 Information about the W32/MyLife.M Worm:

W32/MyLife.M is an email worm. It is a variant of MyLife.A. This worm will infect Windows systems. It spreads via email using the email addresses present in Microsoft Outlook address book.

It arrives with the any one of the following subjects:

Old Shakira
Fw: Julia Roberts

The body of the mail will be from any one of the following sets:

Set 1:

Hi i saw this good ASS,, i sleep 3 hours ;-) check Shakira ass soory Shakira movi :)

========No virus detected======== MCAFEE.COM

Set 2:

Hi How are you? Lexy and Mystique, a couple of 18 yr old bi gothic chicks, came over and had some fun in our shower. This scene looks even better on video, check em out at gotgiclex.com

========No virus detected======== MCAFEE.COM

The infected mail carries an attachment with any of the following names:

Shakira_1997_part_1_.Mpeg_.scr
Julia_Roberts_*******_toilet.Mpeg_.scr

Upon execution of infected attachment, the worm drops a 0-byte file MyLife.mpg, in the root of C: drive and tries to execute it. Since it fails to execute, default media player returns an error message. The worm copies itself with the following names in the Windows system folder.

* Shakira_1997_part_1_.Mpeg_.scr
* Julia_Roberts_*******_toilet.Mpeg_.scr

After this the worm uses Microsoft Outlook address book to propagate itself.

The worm makes necessary changes to the registry at the following location to load itself at next system startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm has a payload, when it is executed from Windows System folder, if the minute is greater than 50 of an hour then it deletes the files in the following locations:

Windows\System\*.*
Windows\*.sys
d:\*.*
e:\*.*
f:\*.*

This worm first appeared on 3rd July 2003.

 Other names of W32/MyLife.M worm :

This worm is also known as W32/Mylife.m@MM ,WORM_MYLIFE.M, I-Worm.Mylife, W32/MyLife-M.