VIRUS ALERT No.55 -- Wednesday, February 28, 2001
Myba virus (aka MYBABYPIC)
Kaspersky Lab is warning about a new worm which is a modification of the LoveLetter worm.
Kaspersky Labs warns computer users about the possible recurrence of the epidemic of the LoveLetter worm which may be caused by its new modification - "Myba" (aka "MYBABYPIC")! Kaspersky Lab, together with other anti-virus developers, has already received several reports of the worm "in-the-wild".
"Myba" arrives as an EXE file written in Visual Basic programming language, afterwards compiled into an EXE application. Portions of the worm's code are very clearly based on the infamously-known "LoveLetter" worm as some of their routines are nearly identical.
"Myba" spreads via e-mail messages containing the infected attached file MYBABYPIC.EXE. The message appears as follows:
The Subject: My baby pic !!!
Message body: Its my animated baby picture !!
Attached file name: mybabypic.exe
When the attached file is run, the worm registers itself in the system
and distributes its copies, without the knowledge of the user, to all e-mail
addresses found in the MS Outlook address book. The subject, message-body
and name of the attached file are the same as above.
When installing into the system, "Myba" creates a set of files in the Windows system folder containing the worm's copies, and registers them in the startup section of the Windows system registry. This allows the worm to be executed each time the computer is started.
"Myba" carries a very dangerous payload that can easily destroy important data on your computer. Depending on the current time and date, “Myba”:
switches on/off NumLock, CapLock and ScrollLock keys
sends to keyboard buffer the message: ".IM_BESIDES_YOU_"
connects the http://www.youvebeenhack.com site and sends there one of the
following text
messages:
FROM BUGGER
HAPPY VALENTINES DAY FROM BUGGER
HAPPY HALLOWEEN FROM BUGGER
"Myba" also enumerates all the available disk drives, and corrupts
files having the following extensions:
VBS, VBE, JS, JSE, CSS, WSH, SCT, HTA, PBL, CPP, PAS, C, H, JPG,
JPEG, MP2, and MP3.
Protection against "Myba" is already available for SOME Anti-Virus
scanners.
Further data can be found here
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5)THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
010301/261201/110904/071004
