Name: I-Worm.MyLife. Category: Viruses Description: Details I-Worm.MyLife.c MyLife is a family of worms (different versions) spreading through the Internet as infected email attachments. The worms themselves are Windows PE EXE files, written in Visual Basic and compressed by the UPX file compression utility. The worm is activated only if users click on the attachment. Once executed, MyLife installs itself into the system and runs its spreading routine. When MyLife is launched for the first time it shows either a window with a picture or message, which one depends on the particular version. Two possible MyLife pictures: While installing this worm copies itself to the Windows System directory and registers this copy (file) in the system registry auto-run key. MyLife uses Microsoft Outlook to send messages to all addresses found in the Microsoft Outlook Address Book. File size : about 8Kb. Decompressed file size : about 25Kb. Email content: Subject: The List Body: Hiiiii How are youuuuuuuu? Here is that Notepad you asked for all don't show anyone else ;-) Notepad = list list = 137 buyyyy ========No Viruse Found======== MCAFEE.COM -------------------------------------------------------- Attachment name: List.TXT.scr File name in the infected system: %SystemDir%List.TXT.scr Affected registry key: HKCUSoftwareMicrosoftWindowsCurrentVersionRun sys=%SystemDir%List.TXT.scr Visual effect: when MyLife is launched for the first time, it displays the following message: Payload: MyLife checks the current date, if the current minute value is greater or equal to 50 it executes format commands for disks D:, E:, F:, G:, H: and I:, it also deletes all the files and directories on disk C:. Then the worm shows the following message: