My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Win32.MyLife.J@mm

LOW
HIGH
22528 bytes
(N/A)

Symptoms

- Files "sh.scr" and
"USA.scr" in the Windows
System
folder;
- The "scr" entry in
the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
registry key, causing "sh.scr"
from the Windows System folder
to be run at start-up:

Removal instructions:

  1. If you don't have BitDefender installed click here to download an evaluation version;

  2. Make sure that you have the latest updates using BitDefender Live!;

  3. Make the following changes in the windows registry:

    Note: Please make sure to modify only the values that are specified. It is also recommended to backup the windows registry before proceeding with these changes. For more information on backing the registry please read the FAQ.

    1. Select Run... from Start, then type regedit and press Enter;

    2. Delete the following key:
      HKCU\Software\Microsoft\Windows\CurrentVersion\Run

  4. Perform a full scan of your system (selecting, from the Action tab, the option Prompt user for action). Choose to delete all the files infected with Win32.MyLife.J@mm.

Analyzed By

Bogdan Dragu<br /> BitDefender Virus Researcher

Technical Description:

This is another mass-mailer in the Win32.MyLife
series, that spreads by e-mail (using Microsoft Outlook) to the user's contacts.
It was written in Visual Basic and packed using UPX.
It arrives as an attachment
to an e-mail message in this format:


Subject:
sexyy Screen Saver

Body:
hi
look to the screen saver it's very funny
bye


Attachment:

"USA.scr" (size: ~ 22 KB)




When run, the virus will copy itself as "sh.scr"
and "USA.scr" in the
Windows System folder and register
"USA.scr" to be run every
time the user logs on to Windows (by creating the registry entry described in
the Symptoms section).

The virus will send e-mail
messages to the user's contacts in the Address Book and the MSN Messenger contact
list (in the format described above). It will also send a message to the address
zary2000@email.com (that also
includes the virus body as an attachment) in the following format:


Bcc:
zary2000@email.com

Subject:
funny Screen Saver

Body:
hi all,
look to the 3D screen saver it's very funny
bye


Attachment:
sh.scr





Eventually the virus will display the following picture:



Payload: Under certain
conditions (such as a specific hour of the day or date) the virus will attempt
to delete all folders on drive C:.