March 23, 2001 Security Advisory

New virus: “MyLife”

I have been paying attention to this worm for a few day. Today, I decided to
send you this warning because multiple sources are seeing damage caused by the
virus. Symantec has raised this one to a level 3, which means that a lot of
computers are getting hit. Also, according to a British-based e-mail security
services provider MessageLabs Inc., “MyLife” was the most active virus on
Friday, with nearly 2,000 samples intercepted. It has affected users in 29
countries, most strongly in Great Britain, the United States and Australia.

W32.MyLife.B@mm is a mass-mailing worm that uses Microsoft Outlook to spread to
all addresses in the Outlook address book. 
It copies itself to C:\Windows \System\Cari.scr and may delete files, 
depending on the system time.

NOTE: Definitions dated prior to March 22, 2002 will detect this as 32.Caric@mm.
Also Known As: W32.Caric@mm 
Type: Worm 
Infection Length: 11,524 bytes 

Here is a description and content of the infected message:

Email subject: bill caricature
Attached file: cari.scr
Message text:
Hiiiii
How are youuuuuuuu?
look to bill caricature it's vvvery verrrry ffffunr 
i promise you will love it? ok
buy

========No Viruse Found========
         MCAFEE.COM 

The attachment contains a file with a caricature of Bill Clinton blowing into a
saxophone (with a lady’s bra hanging at the end of the saxophone).

Recommendation: If you see the email, delete it immediately, update your
antivirus signatures and scan your computer. If you have the virus, go to your
antivirus vendor’s website and follow removal instructions.

* To ensure your privacy, your address is not visible to the recipients of this
message.
* If you would like to be removed from this list, please reply to this email
* with "remove" in the body of the email.

Have a safe computing experience and don't forget to back up your files!

Fredo Martin
http://www.workingarts.com/infosecarchives