F-Secure Virus Descriptions : MyPics

NAME:	MyPics
ALIAS:	Pic4You, I-Worm.MyPics

This MyPics worm is a Visual Basic application that usually arrives as an attachment to an e-mail message with the text 'Here's some pictures for you!' in the message body and no subject line. When started, the worm installs itself to system as C:\Pics4You.EXE and modifies Windows registry so that it is always run when Windows is started. The worm needs Visual Basic run-time library MSVBVM50.DLL to be started and if it is missing it will not infect the system and spread further on. Being active the worm sends itself to 50 users at a time. The e-mail addresses of victims the worm finds in Outlook address book. The worm doesn't send itself twice from the same computer.

The worm has a dangerous payload that will be activated on the 1st of January 2000. The worm will drop and run the CBIOS.COM file that will corrupt CMOS data and then replace AUTOEXEC.BAT with commands that will format hard drives C: and D: after system reboots.

VARIANT: MyPics.b

ALIAS: ICQ_Greetings, I-Worm.MyPics.b

This variant is based on the MyPics worm source code. So it has minor differences from the MyPics worm. The message the worm spreads itself with is 'Season's Greetings' and it installs itself as C:\ICQ_Greetings.EXE. Spreading via Outlook is similar to MyPics.

The payload is slightly different as well. On 1st of January 2000 the worm changes Windows registration settings to:

 'RegisteredOwner' = Mike Carmody
 'RegisteredOrganization' = 2034 Langley Ct. Holloman Afb, NM 88330

This version of the worm formats not only C: and D: hard disks, but also F:, U: and diskettes A: and B:. An additional payload was added. The worm will delete files with masks and in folders specified below on 1st of January 2000:

 c:\*.c*
 d:\*.c*
 c:\WinNt\System\*.c*
 c:\WinNt4\System\*.c*
 c:\Windows\System\*.c*
 c:\WinNt\System\*.o*
 c:\WinNt4\System\*.o*
 c:\Windows\System\*.o*
 c:\WinNt\*.i*
 c:\WinNt4\*.i*
 c:\Windows\*.i*

VARIANT: MyPics.c

ALIAS: Video, I-Worm.MyPics.c

This third variant is also based on the MyPics worm source code. The message the worm spreads itself with is 'Here's a digital video for you'. The worm installs itself as C:\Zip01.EXE. Spreading via Outlook is similar to MyPics.

On 17th day of each month this worm variant will delete files with masks and in folders specified below:

 c:\*.c*
 d:\*.c*
 c:\WinNt\System\*.c*
 c:\WinNt4\System\*.c*
 c:\Windows\System\*.c*
 c:\WinNt\System\*.o*
 c:\WinNt4\System\*.o*
 c:\Windows\System\*.o*
 c:\WinNt\*.i*
 c:\WinNt4\*.i*
 c:\Windows\*.i*

[Analysis: Alexey Podrezov, F-Secure; Eugene Kaspersky, AVP team]