This MyPics worm is a Visual Basic application that usually arrives as an attachment to an email message with the text 'Here's some pictures for you!' in the message body and no subject line. When started, the worm installs itself to system as C:\Pics4You.EXE and modifies Windows registry so that it is always run when Windows is started. The worm needs Visual Basic run-time library MSVBVM50.DLL to be started and if it is missing it will not infect the system and spread further on. Being active the worm sends itself to 50 users at a time. The email addresses of victims the worm finds in Outlook address book. The worm doesn't send itself twice from the same computer.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The worm has a dangerous payload that will be activated on the 1st of January 2000. The worm will drop and run the CBIOS.COM file that will corrupt CMOS data and then replace AUTOEXEC.BAT with commands that will format hard drives C: and D: after system reboots.
Variant:MyPics.b (ICQ_Greetings, I-Worm.MyPics.b)
This variant is based on the MyPics worm source code. So it has minor differences from the MyPics worm. The message the worm spreads itself with is 'Season's Greetings' and it installs itself as C:\ICQ_Greetings.EXE. Spreading via Outlook is similar to MyPics.
The payload is slightly different as well. On 1st of January 2000 the worm changes Windows registration settings to:
'RegisteredOwner' = Mike Carmody 'RegisteredOrganization' = 2034 Langley Ct. Holloman Afb, NM 88330
This version of the worm formats not only C: and D: hard disks, but also F:, U: and diskettes A: and B:. An additional payload was added. The worm will delete files with masks and in folders specified below on 1st of January 2000:
c:\*.c* d:\*.c* c:\WinNt\System\*.c* c:\WinNt4\System\*.c* c:\Windows\System\*.c* c:\WinNt\System\*.o* c:\WinNt4\System\*.o* c:\Windows\System\*.o* c:\WinNt\*.i* c:\WinNt4\*.i* c:\Windows\*.i*
Variant:MyPics.c (Video, I-Worm.MyPics.c)
This third variant is also based on the MyPics worm source code. The message the worm spreads itself with is 'Here's a digital video for you'. The worm installs itself as C:\Zip01.EXE. Spreading via Outlook is similar to MyPics.
On 17th day of each month this worm variant will delete files with masks and in folders specified below:
c:\*.c* d:\*.c* c:\WinNt\System\*.c* c:\WinNt4\System\*.c* c:\Windows\System\*.c* c:\WinNt\System\*.o* c:\WinNt4\System\*.o* c:\Windows\System\*.o* c:\WinNt\*.i* c:\WinNt4\*.i* c:\Windows\*.i*