ITinfo: MyPics Worm Causes Y2K Problems

Site Directory
Membership
Train-the-Trainer
Trainer Certification
Certified Training Materials
ITinfo E-zine
Responsible Training
White Papers
Trainer Resources
What's New
Speaking Engagements
Onsite Training
ITrain Gear

MyPics Worm: Porno & Y2K

New worm shows porno, reformats hard disks

ITinfo Sponsor

ERROR: Random File Unopenable

The random file, as specified in the $random_file perl variable was unopenable.

The file was not found on your file system. This means that it has either not been created or the path you have specified in $trrandom_file is incorrect.

MyPics Worm Causes Y2K Problems

by Dave Murphy
ISSN 1535-3613

A new virus, disguised as a Y2K problem was reported by Symantec this morning. The W32/Mypics.worm (a.k.a. Worm.Mypic) is transmitted via email file attachment. The email message has no subject line, and the attachment is a 33kb file named Pics4You.exe.

When executed the file changes the Microsoft Internet Explorer default homepage to an adult website address. It also loads into memory and grabs the first 50 names in the MS Outlook address book and attempts to mail itself 20 minutes later to those 50 addresses and repeats the transmission every 10 minutes.

Currently, infected users may manually delete registry-key files from their computers to eradicate MyPic.

If not cleaned, on 1/1/2000 the program will create the file C:\CBIOS.COM which will write over the PC's checksum data in the system BIOS, also known as the CMOS. A message will appear during boot up: "CMOS checksum is invalid."

This message may create the impression of a Y2K problem with this computer, because the CMOS maintains the system clock, which can possibly be affected by the transition to the year 2000.

Then, when the CMOS error message is corrected, during the next boot the worm will format both the C: and D: drives by creating a new file in the FAT.

Call for Comments

What do you think? False Y2K alarms? If the actual transition to 2000 won't get you, a fake-out worm will. Leave your comments on the message center.

References

Symantec
Message Center

Previous issues are on our website at http://itrain.org/itinfo/.

International Association of Information Technology Trainers
PMB 616
6030-M Marshalee Dr
Elkridge, MD 21075-5987

410.567.5366
1.888.290.6200
fax: 801.650.0423
Membership Director: member@itrain.org

Return to ITrain Homepage

http://itrain.org/itinfo/1999/it991203a.html
updated December 3, 1999