|Place of Origin|
|Source Language||Visual Basic|
|File type||.exe, .scr|
Mylife is a malicious, destructive worm that deletes important system files. The original and its later variants displayed pictures and from this it became known by some other (not as often used) names, including Caricature (or some shortened form of that word) and the Bill Clinton worm (variant B only). The icons it used were also interesting.
Mylife arrives as an email attachment named "My Life.scr".The subject of the email is "my life ohhhhhhhhhhhhh" and the message body will look like:
Hiiiii How are youuuuuuuu? look to the digital picture it's my love vvery verrrry ffffunny :-) my life = my car my car = my house
When it is executed, the worm copies itself to the system folder as the same name as the attachment. The worm adds itself to the current user run registry key It displays a picture of a woman dressed in antique fancy clothes holding a flower.
The worm mails itself to all addresses in the Windows address book.
It checks if a variable is equal to or greater than 45 and if so begins deleting certain files. The worm deletes all .sys and .com files in the C:\ root folder, all .com, .sys, .ini, and .exe in the Windows folder and .sys, .vxd, .exe, and .dll files in the System folder.
This variant promises a Bill Clinton caricature (Clinton was out of office over a year before this variant appeared. It comes in the attachment "CARI.SCR", with a subject line of "bill caricature" and a message body like this:
Hiiiii How are youuuuuuuu? look to bill caricature it's vvvery verrrry ffffunny :-) :-) i promise you will love it? ok buy ========No Viruse Found======== MCAFEE.COM ----------------------------
When the attachment is executed, Mylife.B displays a caricature of former US President Bill Clinton. This variant's payload triggers when CARI.SCR is in the system directory and the hour value is equal to 8. In addition to all addresses in the address book, it gets email adresses from the MSN Messenger database. Mylife.B deletes .sys files in the Windows directory and .vxd, .sys, .ocx, and .nls files in the system directory and all files in the root directories of drives C:, D:, E:, and F:.
The largest number of infections of this variant were in Australia and Britain. It comes in an attachment named "List480.TXT.scr" in an email whose subject line is "the list". The message body is:
Hiiiii How are youuuuuuuu? look to the notepad it's vvvery verrrry ffffunny :-) :-) i promise you will love it :-) Notepad = list list = 37 buyyyy ========No Viruse Found======== MCAFEE.COM --------------------------------
Mylife.G, I and JEdit
These three variants are not particularly remarkable, aside from the fact that they display a caricature of then-Israeli president Ariel Sharon as a bull. Mylife.G overwrites MP3 files with the text "my lIfE".
This variant appeared in 2003 July. It is 8,192 bytes long. It comes in one of two emails. One possibility is that its subject line will be " Fw: Julia Roberts" and the attachment will be "Julia_Roberts_F*cking_toilet.Mpeg_.scr". In this case, the body of the message will look like this:
Hi How are you? Lexy and Mystique, a couple of 18 yr old bi gothic chicks, came over and had some fun in our shower. This scene looks even better on video, check em out at gotgiclex.com ========No virus detected======== MCAFEE.COM"
Otherwise, the subject will be "Old Shakira" and the the attachment will be "Shakira_1997_part_1_.Mpeg_.scr". In this case the body will be:
Hi i saw this good ASS,, i sleep 3 hours ;-) check Shakira ass soory Shakira movi :) ========No virus detected======== MCAFEE.COM"
When Mylife.M is executed, it creates a file named MyLife.mpg in the rot directory of the C: drive and tries to run the Windows media player. It creates two copies of itself in the system directory named "Julia_Roberts_F*cking_toilet.Mpeg_.scr" and "Shakira_1997_part_1_.Mpeg_.scr". It adds one of these files as a value to the local machine Run registry key. It deletes all files on the D:, E: and F: drives and all .sys files in the Windows directory.
A Central Command product manager said mostly home users were affected.
With both the original and the variants, many antivirus researchers had difficulty getting the payload to run on their test systems.
A. Podrezov, K. Tocheva, M. Hypponen, G. Erdelyi. F-Secure, F-Secure Virus Descriptions : Mylife. 2003.07.07
Douglas Knowles. Symantec, W32.MyLife@mm. 2007.02.13
Jaikumar Vi Jayan. CNN Sci-Tech, 'Clinton' e-mail worm attempts to delete files. 2002.03.26
John Leyden. The Register, Clinton worm variant makes fun of Sharon. 2002.04.12
-. -, MP3 zapping malware worms onto P2P network. 2005.04.22