"My Life" trojan

Peano · 06-09-2009, 02:18 PM

I recently received email saying a close relative of mine (he was named) had invited me to join "My Life," with a link to join. I smelled a Trojan and deleted the email. I was right. It had sent this invitation to everyone in his Outlook address book.

I haven't turned up any information about this on Google. Does anyone have information I could pass along to him to help him delete this trojan? Many thanks.

sethvel1 · 06-10-2009, 02:09 PM

This is an old virus that should be picked up by any AV, (suggest Kaspersky) or you can locate the files yourself. When the worm's file is run, it creates an empty file with the name 'MyLife.mpg' in the root of C: drive and tries to open it with Windows Media Player. Then the worm it copies itself to Windows System folder with the following names:

Julia_Roberts_F*cking_toilet.Mpeg_.scr
Shakira_1997_part_1_.Mpeg_.scr

Then it creates a startup key for one of its files in System Registry:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Win32" = "%winsysdir%\Shakira_1997_part_1_.Mpeg_.scr"

Peano · 06-10-2009, 02:45 PM

Quote:

Originally Posted by sethvel1

This is an old virus that should be picked up by any AV, (suggest Kaspersky) or you can locate the files yourself. When the worm's file is run, it creates an empty file with the name 'MyLife.mpg' in the root of C: drive and tries to open it with Windows Media Player. Then the worm it copies itself to Windows System folder with the following names:

Julia_Roberts_F*cking_toilet.Mpeg_.scr
Shakira_1997_part_1_.Mpeg_.scr

Then it creates a startup key for one of its files in System Registry:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Win32" = "%winsysdir%\Shakira_1997_part_1_.Mpeg_.scr"

Thank you. I'll pass this information along, though I'm not sure it's the same virus. The email I received had no attachment to open. It invited recipients to visit a website an join "My Life" -- supposedly as a way to keep in touch with friends. Joining the site is what triggered the virus for my relative.

sethvel1 · 06-10-2009, 03:03 PM

Sorry bout that, maybe read this:
http://techpaul.wordpress.com/2009/0...-to-mylifecom/

06-09-2009, 02:18 PM	#1 (permalink)
Peano Registered User Join Date: Jun 2009 Posts: 15 OS: Windows XP Pro SP3	"My Life" trojan I recently received email saying a close relative of mine (he was named) had invited me to join "My Life," with a link to join. I smelled a Trojan and deleted the email. I was right. It had sent this invitation to everyone in his Outlook address book. I haven't turned up any information about this on Google. Does anyone have information I could pass along to him to help him delete this trojan? Many thanks.

06-10-2009, 02:09 PM	#2 (permalink)
sethvel1 Registered User Join Date: Jun 2009 Location: Morrisville NC Posts: 26 OS: windows xp pro	Re: "My Life" trojan This is an old virus that should be picked up by any AV, (suggest Kaspersky) or you can locate the files yourself. When the worm's file is run, it creates an empty file with the name 'MyLife.mpg' in the root of C: drive and tries to open it with Windows Media Player. Then the worm it copies itself to Windows System folder with the following names: Julia_Roberts_F*cking_toilet.Mpeg_.scr Shakira_1997_part_1_.Mpeg_.scr Then it creates a startup key for one of its files in System Registry: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Win32" = "%winsysdir%\Shakira_1997_part_1_.Mpeg_.scr"

06-10-2009, 03:03 PM	#4 (permalink)
sethvel1 Registered User Join Date: Jun 2009 Location: Morrisville NC Posts: 26 OS: windows xp pro	Re: "My Life" trojan Sorry bout that, maybe read this: http://techpaul.wordpress.com/2009/0...-to-mylifecom/