Classification

Category: Malware

Type: -

Aliases: MyPics, Pic4You, I-Worm.MyPics

Summary


This MyPics worm is a Visual Basic application that usually arrives as an attachment to an email message with the text 'Here's some pictures for you!' in the message body and no subject line. When started, the worm installs itself to system as C:\Pics4You.EXE and modifies Windows registry so that it is always run when Windows is started. The worm needs Visual Basic run-time library MSVBVM50.DLL to be started and if it is missing it will not infect the system and spread further on. Being active the worm sends itself to 50 users at a time. The email addresses of victims the worm finds in Outlook address book. The worm doesn't send itself twice from the same computer.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


The worm has a dangerous payload that will be activated on the 1st of January 2000. The worm will drop and run the CBIOS.COM file that will corrupt CMOS data and then replace AUTOEXEC.BAT with commands that will format hard drives C: and D: after system reboots.


Variant:MyPics.b (ICQ_Greetings, I-Worm.MyPics.b)

This variant is based on the MyPics worm source code. So it has minor differences from the MyPics worm. The message the worm spreads itself with is 'Season's Greetings' and it installs itself as C:\ICQ_Greetings.EXE. Spreading via Outlook is similar to MyPics.

The payload is slightly different as well. On 1st of January 2000 the worm changes Windows registration settings to:

'RegisteredOwner' = Mike Carmody 'RegisteredOrganization' = 2034 Langley Ct. Holloman Afb, NM 88330

This version of the worm formats not only C: and D: hard disks, but also F:, U: and diskettes A: and B:. An additional payload was added. The worm will delete files with masks and in folders specified below on 1st of January 2000:

 c:\*.c*
d:\*.c*
c:\WinNt\System\*.c*
c:\WinNt4\System\*.c*
c:\Windows\System\*.c*
c:\WinNt\System\*.o*
c:\WinNt4\System\*.o*
c:\Windows\System\*.o*
c:\WinNt\*.i*
c:\WinNt4\*.i*
c:\Windows\*.i*


Variant:MyPics.c (Video, I-Worm.MyPics.c)

This third variant is also based on the MyPics worm source code. The message the worm spreads itself with is 'Here's a digital video for you'. The worm installs itself as C:\Zip01.EXE. Spreading via Outlook is similar to MyPics.

On 17th day of each month this worm variant will delete files with masks and in folders specified below:

 c:\*.c*
d:\*.c*
c:\WinNt\System\*.c*
c:\WinNt4\System\*.c*
c:\Windows\System\*.c*
c:\WinNt\System\*.o*
c:\WinNt4\System\*.o*
c:\Windows\System\*.o*
c:\WinNt\*.i*
c:\WinNt4\*.i*
c:\Windows\*.i*