This MyPics worm is a Visual Basic application that usually
arrives as an attachment to an e-mail message with the text
'Here's some pictures for you!' in the message body and no
subject line. When started, the worm installs itself to system as
C:\Pics4You.EXE and modifies Windows registry so that it is
always run when Windows is started. The worm needs Visual Basic
run-time library MSVBVM50.DLL to be started and if it is missing
it will not infect the system and spread further on. Being active
the worm sends itself to 50 users at a time. The e-mail addresses
of victims the worm finds in Outlook address book. The worm
doesn't send itself twice from the same computer.
The worm has a dangerous payload that will be activated on the
1st of January 2000. The worm will drop and run the CBIOS.COM
file that will corrupt CMOS data and then replace AUTOEXEC.BAT
with commands that will format hard drives C: and D: after system
reboots.
This variant is based on the MyPics worm source code. So it has
minor differences from the MyPics worm. The message the worm
spreads itself with is 'Season's Greetings' and it installs
itself as C:\ICQ_Greetings.EXE. Spreading via Outlook is similar
to MyPics.
The payload is slightly different as well. On 1st of January 2000
the worm changes Windows registration settings to:
'RegisteredOwner' = Mike Carmody
'RegisteredOrganization' = 2034 Langley Ct. Holloman Afb, NM 88330
This version of the worm formats not only C: and D: hard disks,
but also F:, U: and diskettes A: and B:. An additional payload
was added. The worm will delete files with masks and in folders
specified below on 1st of January 2000:
c:\*.c*
d:\*.c*
c:\WinNt\System\*.c*
c:\WinNt4\System\*.c*
c:\Windows\System\*.c*
c:\WinNt\System\*.o*
c:\WinNt4\System\*.o*
c:\Windows\System\*.o*
c:\WinNt\*.i*
c:\WinNt4\*.i*
c:\Windows\*.i*
This third variant is also based on the MyPics worm source code.
The message the worm spreads itself with is 'Here's a digital
video for you'. The worm installs itself as C:\Zip01.EXE.
Spreading via Outlook is similar to MyPics.
On 17th day of each month this worm variant will delete files
with masks and in folders specified below:
c:\*.c*
d:\*.c*
c:\WinNt\System\*.c*
c:\WinNt4\System\*.c*
c:\Windows\System\*.c*
c:\WinNt\System\*.o*
c:\WinNt4\System\*.o*
c:\Windows\System\*.o*
c:\WinNt\*.i*
c:\WinNt4\*.i*
c:\Windows\*.i*
[Analysis: Alexey Podrezov, F-Secure; Eugene Kaspersky, AVP team]