1. Home
  2. Computing & Technology
  3. Antivirus Software
MyLife.F Worm
Virus Description
 Related Resources
• Words Can Hurt You
• MyLife.A Worm
• MyLife.B Worm
• Virus Encyclopedia
• Glossary of terms
 
 Elsewhere on the Web
• F-Secure Description
• MessageLabs ThreatList
 

Discovered on April 2, 2002, the MyLife.F worm quickly gained momentum, reaching the number three spot on the MessageLabs ThreatList within 24 hours of its initial discovery. Affecting mainly users in Great Britain, the worm also spread in the U.S. and Australia. MyLife.F makes use of little social engineering, aside from a bogus promise that the email is clean. Following the theme of its predecessor, MyLife.B, the worm carries the message:

========No Viruse Found========
MCAFEE.COM

and like its predecessor, it is, of course, an email worm. In this instance, words can hurt you as it may lead to a sense of false security.

MyLife.F arrives in an email with the subject line of 'the list' and body text that reads:

Hiiiii
How are youuuuuuuu?
look to the notepad it's vvvery verrrry ffffunny :-) :-)
i promise you will love it :-)
Notepad = list
list = 37
buyyyy

========No Viruse Found========
         MCAFEE.COM

The attachment is named 'List480.TXT.scr' and erroneously displays a misleading icon. On Windows systems with default configurations, the real '.scr' extension is suppressed and such a ruse could cause many to believe the email is a harmless text file. To prevent such a ruse, Windows users should ensure that file extension viewing is enabled on their system.

If the attachment is opened, the user will first see a message dialog indicated an error in the non-existent notepad.dll file, after which it modifies the registry to load itself on startup. If MyLife.F is activated when the system clock minutes are 50 or above, the worm attempts to delete all files from the local C:\ drive and format drives D:\ through I:\ if they exist.

Removing the worm
Delete the value 'sys' from the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\run
Search for and delete any files named 'List480.TXT.scr'.

Antivirus software updated after April 2, 2002 should be able to detect and remove this worm.

Subscribe to the Newsletter
Name
Email

Explore Antivirus Software
About.com Special Features

Stay connected and entertained with reviews on tips on the latest HDTVs, cellphones and more. More >

Easy ways to connect two computers for networking purposes. More >

  1. Home
  2. Computing & Technology
  3. Antivirus Software

©2009 About.com, a part of The New York Times Company.

All rights reserved.