SAN FRANCISCO: An Internet worm, disguised as a screensaver cartoon of former
US President Bill Clinton playing the saxophone, that can delete files and slow
network connections was spreading on Friday, antivirus software vendors said.
The worm, dubbed "MyLife.b," was rated a medium risk because of its
demonstrated ability to lure users to open it and the way it tries to delete
files, said April Goostree, virus research manager at McAfee.com Corp. It
affects Microsoft Outlook users. However, the Outlook E-mail Security Update,
downloadable for Office 2000 and 98 users and included in Outlook 2002, blocks
executable attachments, Microsoft said.
The worm is embedded in an executable file in the attachment that comes with
an e-mail with the subject line "bill caricature." The e-mail also
attempts to mislead people into thinking it has been scanned by an antivirus
vendor and found to be safe. In the body of the e-mail is the message "No
Viruse Found" (sic) and "McAfee.com." However, Goostree said
anti-virus messages are never delivered to customers that way.
Once the attachment is opened, the worm drops a copy of itself in the
computers' system folder and if the computer is rebooted between the hours of 8
am and 9 am it will try to delete all files on the C, D, E and F drives and
certain files in the Windows system directory, according to Goostree.
The worm also may slow down computer users' e-mail and Internet connections,
according to McAfee.com. Goostree said she did not know where the worm
originated, but noted that Australia has been hit particularly hard. The worm
appeared to have started slowing down by midday on Friday, she said.
British-based e-mail security services provider MessageLabs Inc. said MyLife
was the most active virus on Friday, with nearly 2,000 samples intercepted. It
has affected users in 29 countries, most strongly in Great Britain, the United
States and Australia, the company's Web site said.