This is another
mass-mailer in the Win32.MyLife
series, that spreads by e-mail (using Microsoft Outlook) to the user's contacts.
It was written in Visual Basic and packed using UPX
It arrives as an attachment
to an e-mail message in this format:
look to the 3d Picture it's very sad
"peeeeep~~~.scr" (size: ~ 12 KB)
When run, the virus will copy itself as
"ox&Wife.scr" and "peeeep~~~.scr"
in the Windows System folder and
register the "ox&Wife.scr"
dropped copy to be run every time the user logs on to Windows (by creating the
registry entry described in the Symptoms section). This might only happen once,
as the virus has a very distructive payload routine.
The virus will send e-mail
messages to the user's contacts in the Address Book and the MSN Messenger contact
list (in the format described above). It will also send a message to the address
firstname.lastname@example.org (that also
includes the virus body as an attachment) in the following format:
Digital Picture --> OX
look to the 3D Picture it's very sad
Eventually the virus will display the following picture:
When run for the
second time (eg: when the user restarts Windows), the virus will attempt to overwrite
all files in the folders of the hard-disk drive partitions (the original contents
of these files will be replaced with a single whitespace character).