What's Wrong With This Picture?
Hoax warnings urging users to beware of emails received with the subject line "NEW PICTURES OF FAMILY" are increasingly achieving a high rate of spread. Now joining these false alerts are legitimate virus warnings of "My Baby Picture".
MyBabyPic is a real virus, actually a VisualBasic worm that uses some of the same coding and techniques employed by the notorious Loveletter virus. The virus affects only Windows operating systems. Patrick Nolan, virus researcher for McAfee's AVERT (Antivirus Emergency Response Team), indicated that "infection rates are higher within the Philippines, but given the nature of the virus, users may conceivably assist in the viruses spread." According to Patrick, "the attachment will display an animated graphic, one of a baby in a baby crib with an adult-sized penis. The animation effect is that the penis is in two different positions. Due to the graphic nature of this display, it is possible that users would manually and intentionally forward the attachment to others, in a gesture of passing along something humurous."
MyBabyPic is received via email carrying the subject line: "My baby pic!!!" with accompanying body text, "Its my animated baby picture !!". When the attachment, mybabypic.exe, is opened, the animation plays and no apparent malicious action occurs. Several minutes later, however, the virus emails itself to other users listed in the address book. Because the mass-mailing is delayed, users may be unaware of the worms actions. Denis Zenkin of Kaspersky Labs reports that MyBabyPic "also enumerates all the available disk drives, and corrupts files having the following extensions: VBS, VBE, JS, JSE, CSS, WSH, SCT, HTA, PBL, CPP, PAS, C, H, JPG, JPEG, MP2, and MP3."
Depending on the antivirus vendor, MyBabyPic may be called W32/Babypic@mm, TROJ_Mybabypic.A MYBABYPIC.EXE, I-Worm.Myba, Myba, or W32/Myba-A among others.

