Home / malware

PDF

Win32.MyLife.C@mm

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Win32.MyLife.C@mm is also known as N/A.

Explanation :

This virus is another sequel to Win32.MyLife.A@mm: a mass-mailer that uses Microsoft Outlook to send itself to the user's contacts, written in Visual Basic and packed using the UPX packer.

It arrives as an attachment to an e-mail message in this format:

Subject:The List
Body:
Hiiiii
How are youuuuuuuu?
Here is that Notepad you asked for ... don't show anyone else ;-)
Notepad = list
list = 137
buyyyy

========No Viruse Found========
MCAFEE.COM
--------------------------------------------------------

Attachement: "List.TXT.scr" (size: ~ 8 KB)



The attachment's filename extension is (as before) chosen to fool the user into thinking it is a Windows screen-saver. When run, the virus first displays an "error" message box:



then drops a copy of itself in the Windows System folder and registers it to be run each time the "infected" user logs on to Windows. The virus will send copies of itself to all the user's contacts in the Address Book and MSN Messenger's Contact List, by creating e-mail messages in the format described above.
As a payload, the virus attempts (under certain conditions, such as a specific day and minute of the hour) to format some hard-disk partitions (D:, E:, F:, G:, H:, I:) and to delete all of the folders in the C: hard-disk partitions; the result of this action, if successful, would be the loss of almost all of the data on the user's hard-disk(s). The virus will also display the message "LoOoOoL" while erasing the data.

Last update 21 November 2011

 

TOP