Sophos

W32/MissWorld

Aliases
  • W32/MsWorld@MM
  • I-Worm.MsWorld
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

W32/MissWorld is an email-aware worm. It forwards itself to contacts in your Microsoft Outlook address book in an email with the following characteristics:

Subject: Miss World

Message text:
Hi, <name of recipient> Enjoy the latest pictures of Miss World from various Country

Attached file: misworld.exe
(Note: Other vendors have reported seeing samples of this virus distributed with the filename MissWorld.exe, MWld.exe and MWrld.exe)

When the attached file is executed, a Macromedia Flash program displays a cartoon of a birthday cake with the phrase "I fall more in love with you each day!" displayed underneath.

Flash cartoon of a birthday cake

The worm also shows images claiming to be contestants in the Miss World beauty contest. Images shown include those claiming to be Miss Africa (who appears with her head replaced with that of a gorilla), Miss UK (who appears with her head replaced with that of Rowan Atkinson's comedy character Mr Bean) and Miss Finland.

Miss UK with Rowan Atkinson's head

The worm makes changes to C:\AUTOEXEC.BAT such that on the next reboot the message

"This Everything for my Girl Friend........., (CatEyes, KRSSL, SS Hostel)"

is displayed. The worm then attempts to format the C: drive and delete the file C:\windows\system.dat.
is displayed and drive C: is formatted. The worm also attempts to delete the file C:\windows\system.dat.

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer