Threat Description

MyPics

Details

Aliases:MyPics, Pic4You, I-Worm.MyPics
Category: Malware
Type:
Platform: W32

Summary



This MyPics worm is a Visual Basic application that usually arrives as an attachment to an e-mail message with the text 'Here's some pictures for you!' in the message body and no subject line. When started, the worm installs itself to system as C:\Pics4You.EXE and modifies Windows registry so that it is always run when Windows is started. The worm needs Visual Basic run-time library MSVBVM50.DLL to be started and if it is missing it will not infect the system and spread further on. Being active the worm sends itself to 50 users at a time. The e-mail addresses of victims the worm finds in Outlook address book. The worm doesn't send itself twice from the same computer.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



The worm has a dangerous payload that will be activated on the 1st of January 2000. The worm will drop and run the CBIOS.COM file that will corrupt CMOS data and then replace AUTOEXEC.BAT with commands that will format hard drives C: and D: after system reboots.


Variant:MyPics.b (ICQ_Greetings, I-Worm.MyPics.b)

This variant is based on the MyPics worm source code. So it has minor differences from the MyPics worm. The message the worm spreads itself with is 'Season's Greetings' and it installs itself as C:\ICQ_Greetings.EXE. Spreading via Outlook is similar to MyPics.

The payload is slightly different as well. On 1st of January 2000 the worm changes Windows registration settings to:

'RegisteredOwner' = Mike Carmody 'RegisteredOrganization' = 2034 Langley Ct. Holloman Afb, NM 88330

This version of the worm formats not only C: and D: hard disks, but also F:, U: and diskettes A: and B:. An additional payload was added. The worm will delete files with masks and in folders specified below on 1st of January 2000:

 c:\*.c*
 d:\*.c*
 c:\WinNt\System\*.c*
 c:\WinNt4\System\*.c*
 c:\Windows\System\*.c*
 c:\WinNt\System\*.o*
 c:\WinNt4\System\*.o*
 c:\Windows\System\*.o*
 c:\WinNt\*.i*
 c:\WinNt4\*.i*
 c:\Windows\*.i*
 
 

Variant:MyPics.c (Video, I-Worm.MyPics.c)

This third variant is also based on the MyPics worm source code. The message the worm spreads itself with is 'Here's a digital video for you'. The worm installs itself as C:\Zip01.EXE. Spreading via Outlook is similar to MyPics.

On 17th day of each month this worm variant will delete files with masks and in folders specified below:

 c:\*.c*
 d:\*.c*
 c:\WinNt\System\*.c*
 c:\WinNt4\System\*.c*
 c:\Windows\System\*.c*
 c:\WinNt\System\*.o*
 c:\WinNt4\System\*.o*
 c:\Windows\System\*.o*
 c:\WinNt\*.i*
 c:\WinNt4\*.i*
 c:\Windows\*.i*
 
 




Technical Details: Alexey Podrezov, F-Secure; Eugene Kaspersky, AVP team


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More