1. Technology
MyLife Worm
Virus Description
 Related Resources
• MyLife.B Discovered
• Virus Encyclopedia
• Glossary of terms
 
 Elsewhere on the Web
• F-Secure Description
• MessageLabs ThreatList
 

First discovered by MessageLabs in the early hours of March 7, 2002, the MyLife worm arrives in an email that reads as follows:

Subject: my life ohhhhhhhhhhhhh
Hiiiii
How are youuuuuuuu?
look to the digital picture it's my love
vvvery verrrry ffffunny :-)
my life = my car
my car = my house

The email carries an attachment named My Life.scr. When opened, the worm copies itself to the Windows system directory and modifies the registry to load on startup. MyLife worm them mails itself to all addresses found in the Outlook address book. The worm also displays the picture shown at left.

MyLife includes a destructive payload. According to F-Secure, MyLife deletes files with .com and .sys extensions from the root of the local C:\drive, files with .com, .exe, .ini, and .sys extensions from the Windows folder, and files with .dll, .exe, .sys, and .vxd from the Windows System folder.

Removing the worm
Edit the registry, removing the value "'stmgr' = C:\WINDOWS\SYSTEM\My Life.scr " from the following Registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete the "My Life.scr" file from the Windows System folder.

Few incidents of MyLife have been reported and the worm is considered a low risk. If the MyLife email is received, it should simply be deleted from the system. The worm cannot infect unless the receiver deliberately opens the attachment.

Subscribe to the Newsletter
Name
Email

You can opt-out at any time. Please refer to our privacy policy for contact information.

©2014 About.com. All rights reserved.