high
Summary
Summary
Action- More Information
| Protection available since | 28 September 2003 09:47:09 (GMT) |
|---|---|
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Please follow the instructions for removing worms.
Windows NT/2000/XP
In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Win32
and delete it if it exists.
Close the registry editor.
More Information
W32/MyLife-M is a worm that spreads via email. Using Microsoft Outlook,
W32/MyLife-M sends emails to addresses found in the Outlook address book.
The email has one of the following characteristics:
Subject line: Old Shakira
Message text:
Hi
i saw this good ASS,, i sleep 3 hours ;-)
check Shakira ass soory Shakira movi :)
========No virus detected========
MCAFEE.COM
Attached file: Shakira_1997_part_1_.Mpeg_.scr
Subject line: Fw: Julia Roberts
Message text:
How are you?
Lexy and Mystique, a couple of 18 yr old
bi gothic chicks, came over and
had some fun in our shower. This scene
looks even better on video, check
em out at gotgiclex.com
Attached file: Julia_Roberts_Fucking_toilet.Mpeg_.scr
The worm drops the file C:\MyLife.mpg and attempts to play it.
If W32/MyLife-M is executed in the Windows system folder, the worm checks the time on the system clock. If the number of minutes past the hour is greater than or equal to 50, the worm attempts to delete all SYS files from the Windows folder, all files from the Windows system folder and all files and folders from drives D:, E: and F:
In order to run automatically when Windows starts up, the worm attempts to copy itself to the Windows system folder as a file named Shakira_1997_part_1_.Mpeg_.scr and creates the registry entry
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Win32
pointing to this file. The worm may also create a copy of itself named Julia_Roberts_Fucking_toilet.Mpeg_.scr in the Windows system folder.
|
