ITinfo: MyPics Worm Causes Y2K Problems

MyPics Worm: Porno & Y2K

New worm shows porno, reformats hard disks

ITINFO Sponsor

Isn't that music to your ears?
Why do most marketing programs cost an arm and a leg?
Quit throwing your hard earned money down a rat hole!

With FastTips Newsletters your clients rave about how smart you are for giving them so much free information.
Oh, and by the way, it won't cost you a fortune.

Click to Stop Wasting Money

Internet Poll

Have you attended a seminar via e-learning?

	yes
	no
poll archive

MyPics Worm Causes Y2K Problems

by Dave Murphy
ISSN 1535-3613

A new virus, disguised as a Y2K problem was reported by Symantec this morning. The W32/Mypics.worm (a.k.a. Worm.Mypic) is transmitted via email file attachment. The email message has no subject line, and the attachment is a 33kb file named Pics4You.exe.

When executed the file changes the Microsoft Internet Explorer default homepage to an adult website address. It also loads into memory and grabs the first 50 names in the MS Outlook address book and attempts to mail itself 20 minutes later to those 50 addresses and repeats the transmission every 10 minutes.

Currently, infected users may manually delete registry-key files from their computers to eradicate MyPic.

If not cleaned, on 1/1/2000 the program will create the file C:\CBIOS.COM which will write over the PC's checksum data in the system BIOS, also known as the CMOS. A message will appear during boot up: "CMOS checksum is invalid."

This message may create the impression of a Y2K problem with this computer, because the CMOS maintains the system clock, which can possibly be affected by the transition to the year 2000.

Then, when the CMOS error message is corrected, during the next boot the worm will format both the C: and D: drives by creating a new file in the FAT.

Call for Comments

What do you think? False Y2K alarms? If the actual transition to 2000 won't get you, a fake-out worm will. Leave your comments on the message center.

References

Symantec
Message Center

Damar Group, Ltd. helps business use technology.

ITINFO is again accepting sponsors. Sponsor messages are included in ITINFO's email newsletter and are permanently posted to DGL's website and online reference areas.

ITINFO is an electronic publication of Damar Group, Ltd., publisher of Training Express computer learning guides. Comments and submissions to info@dgl.com.

Previous issues are on our website at http://dgl.com/itinfo/.

updated December 3, 1999
http://dgl.com/itinfo/1999/it991203a.html